GHSA-mqq7-wxx5-mp8h
ps_checkout allows unauthorized method invocation through unvalidated parameter
GHSA-mqq7-wxx5-mp8h is a low vulnerability (CVSS 2.7) in prestashop/ps_checkout, published April 30, 2026. No source lists public exploit code. Fixed in prestashop/ps_checkout 5.3.0.
- Severity
- 2.7 LowCVSS 4.0, GitHub Advisories
- Exploit chance
- UnscoredNo EPSS score yet
- Exploitation
- None knownNot on CISA’s or ENISA’s lists
- Fixed in
5.3.0prestashop/ps_checkout +1 more
Description
Impact
Unvalidated parameter can lead to some unauthorized method invocation with very little possibilities.
Patches
The problem has been patched in versions
- v5.3.0 for PrestaShop 1.7 (build number: 7.5.3.0)
- v5.3.0 for PrestaShop 8 (build number: 8.5.3.0)
- v5.3.0 for PrestaShop 9 (build number: 9.5.3.0)
Read the Versioning policy to learn more about the build numbers.
Credits
PrestaShop thanks PATICEO for reporting the issue.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- Low
- Availability
- None
Affected packages
| Package | Affected | Fixed |
|---|---|---|
prestashop/ps_checkoutPackagist | before 5.3.0 | 5.3.0 |
prestashop/ps_checkoutPackagist | before 5.3.0, plus listed versions v1.0.1v1.0.2v1.0.3v1.0.4v1.0.5 Show 45 moreShow lessv1.0.6v1.0.7v1.0.8v1.0.9v1.1.1v1.1.2v1.1.3v1.1.4v1.1.5v1.1.6v1.1.7v1.1.8v1.2v1.2.1v1.2.10v1.2.10-beta.1v1.2.10-beta.2v1.2.10-beta.3v1.2.10-beta.4v1.2.11v1.2.12v1.2.12-beta.1v1.2.13v1.2.14-beta.1v1.2.14-beta.2v1.2.2v1.2.3v1.2.5v1.2.6v1.2.6-beta.1v1.2.7v1.2.7-beta.1v1.2.7-beta.2v1.2.8v1.2.9v1.3.0v1.3.0-beta.1v1.3.0-beta.2v1.4.0v1.4.1v1.5.0v1.5.1v1.5.2v2.0.0v2.0.1 | 5.3.0 |
What each source reports
GitHub Advisories Score used
ps_checkout allows unauthorized method invocation through unvalidated parameter
Impact
Unvalidated parameter can lead to some unauthorized method invocation with very little possibilities.
Patches
The problem has been patched in versions
- v5.3.0 for PrestaShop 1.7 (build number: 7.5.3.0)
- v5.3.0 for PrestaShop 8 (build number: 8.5.3.0)
- v5.3.0 for PrestaShop 9 (build number: 9.5.3.0)
Read the Versioning policy to learn more about the build numbers.
Credits
PrestaShop thanks PATICEO for reporting the issue.
- Record
GHSA-mqq7-wxx5-mp8h- CVSS 4.0
- 2.7 Low
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:U - Weakness
- CWE-20
- Updated
- 2026-11-02
OSV
ps_checkout allows unauthorized method invocation through unvalidated parameter
Impact
Unvalidated parameter can lead to some unauthorized method invocation with very little possibilities.
Patches
The problem has been patched in versions
- v5.3.0 for PrestaShop 1.7 (build number: 7.5.3.0)
- v5.3.0 for PrestaShop 8 (build number: 8.5.3.0)
- v5.3.0 for PrestaShop 9 (build number: 9.5.3.0)
Read the Versioning policy to learn more about the build numbers.
Credits
PrestaShop thanks PATICEO for reporting the issue.
- Record
GHSA-mqq7-wxx5-mp8h- CVSS 4.0
- 2.7 Low
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:U - Weakness
- CWE-20
- Updated
- 2026-11-02
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | GitHub Advisories, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
References
Left out here: 63 versions. The JSON record has them.