{"id":"CVE-2025-61922","aliases":["EUVD-2025-34790","GHSA-54hq-mf6h-48xh"],"status":"published","title":"PrestaShop Checkout allows customer account takeover via email","description":"PrestaShop Checkout is the PrestaShop official payment module in partnership with PayPal. Starting in version 1.3.0 and prior to versions 4.4.1 and 5.0.5, missing validation on the Express Checkout feature allows silent login, enabling account takeover via email. The vulnerability is fixed in versions 4.4.1 and 5.0.5. No known workarounds exist.","severity":{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-12","score":0.00503,"percentile":0.43528,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":true},"cwes":["CWE-287"],"published":"2025-10-16T17:26:14Z","modified":"2026-10-28T02:30:47Z","exploits":[{"source":"pocgithub","id":"captaincookie34/Vulnerability-Playground-CVE-2025-61922","title":"captaincookie34/Vulnerability-Playground-CVE-2025-61922","date":"2025-11-08","url":"https://github.com/captaincookie34/Vulnerability-Playground-CVE-2025-61922"},{"source":"pocgithub","id":"g0vguy/CVE-2025-61922-PoC","title":"g0vguy/CVE-2025-61922-PoC","date":"2026-01-02","url":"https://github.com/g0vguy/CVE-2025-61922-PoC"}],"fixes":[{"ecosystem":"Packagist","package":"prestashop/ps_checkout","fixed_in":["5.0.5","4.4.1"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Packagist","package":"prestashop/ps_checkout","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.0.0"},{"fixed":"5.0.5"}]}]},{"source":"ghsa","ecosystem":"Packagist","package":"prestashop/ps_checkout","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.3.0"},{"fixed":"4.4.1"}]}]},{"source":"osv","ecosystem":"Packagist","package":"prestashop/ps_checkout","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.3.0"},{"fixed":"4.4.1"}]}],"versions":["v1.3.0","v1.4.0","v1.4.1","v1.5.0","v1.5.1","v1.5.2","v2.0.0","v2.0.1","v2.0.2","v2.0.3","v2.0.4","v2.0.5","v2.0.7","v2.0.8","v2.1.0","v2.10.0","v2.11.0","v2.12.0","v2.12.1","v2.13.0","v2.14.0","v2.15.0","v2.15.1","v2.15.2","v2.15.3","v2.15.4","v2.15.5","v2.16.0","v2.17.0","v2.17.1","v2.18.0","v2.18.1","v2.19.0","v2.2.0","v2.20.0","v2.20.1","v2.20.2","v2.21.0","v2.3.0","v2.4.0","v2.5.0","v2.5.1","v2.5.2","v2.6.0","v2.7.0","v2.7.1","v2.8.0","v2.9.0","v3.0.0","v3.0.1","v3.0.2"]},{"source":"osv","ecosystem":"Packagist","package":"prestashop/ps_checkout","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.0.0"},{"fixed":"5.0.5"}]}],"versions":["v5.0.1","v5.0.2","v5.0.3","v5.0.4","v5.0.4-beta1","v5.0.4-beta10","v5.0.4-beta2","v5.0.4-beta3","v5.0.4-beta4","v5.0.4-beta5","v5.0.4-beta6","v5.0.4-beta7","v5.0.4-beta8","v5.0.4-beta9"]}],"products":[{"vendor":"prestashop","product":"prestashop_checkout"},{"vendor":"prestashopcorp","product":"ps_checkout"}],"references":[{"url":"https://github.com/PrestaShopCorp/ps_checkout/security/advisories/GHSA-54hq-mf6h-48xh","tags":["x_refsource_CONFIRM","Patch","Vendor Advisory","advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-61922","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-54hq-mf6h-48xh"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/61xxx/CVE-2025-61922.json","tags":["advisory"]},{"url":"https://github.com/PrestaShopCorp/ps_checkout","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2025-61922","title":"PrestaShop Checkout allows customer account takeover via email","description":"PrestaShop Checkout is the PrestaShop official payment module in partnership with PayPal. Starting in version 1.3.0 and prior to versions 4.4.1 and 5.0.5, missing validation on the Express Checkout feature allows silent login, enabling account takeover via email. The vulnerability is fixed in versions 4.4.1 and 5.0.5. No known workarounds exist.","status":"published","published":"2025-10-16T17:26:14.999Z","modified":"2025-10-17T14:00:38.84Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical","assessor":"cna"}],"cwes":["CWE-287"],"updated_at":"2026-11-02T14:32:45.105469Z"}],"euvd":[{"id":"EUVD-2025-34790","description":"PrestaShop Checkout is the PrestaShop official payment module in partnership with PayPal. Starting in version 1.3.0 and prior to versions 4.4.1 and 5.0.5, missing validation on the Express Checkout feature allows silent login, enabling account takeover via email. The vulnerability is fixed in versions 4.4.1 and 5.0.5. No known workarounds exist.","status":"published","published":"2025-10-16T17:26:14Z","modified":"2025-10-17T14:00:38Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical"}],"updated_at":"2026-11-02T20:31:30.508055Z"}],"ghsa":[{"id":"GHSA-54hq-mf6h-48xh","title":"PrestaShop Checkout allows customer account takeover via email","description":"# Impact\nMissing validation on Express Checkout feature allows silent log-in\n\n## Affected versions\n\nThe issue was introduced in PrestaShop Checkout 1.3.0 .\n\nAll versions above 1.3.0 are vulnerable except of course the patch versions published on 16/10/2025: 7.4.4.1, 8.4.4.1, 7.5.0.5, 8.5.0.5, 9.5.0.5\n\n# Patches\nThe problem has been patched in versions\n\n- v4.4.1 for PrestaShop 1.7 (build number: 7.4.4.1)\n- v4.4.1 for PrestaShop 8 (build number: 8.4.4.1)\n- v5.0.5 for PrestaShop 1.7 (build number: 7.5.0.5)\n- v5.0.5 for PrestaShop 8 (build number: 8.5.0.5)\n- v5.0.5 for PrestaShop 9 (build number: 9.5.0.5)\n\nRead our [Versioning policy](https://github.com/PrestaShopCorp/ps_checkout/wiki/Versioning) to learn more about our build numbers and versions of PrestaShop Checkout\n\n# Credits\nWe would like to thank [Léo CUNÉAZ](https://github.com/inem0o) for reporting the issue.","status":"published","published":"2025-10-16T19:56:32Z","modified":"2025-10-17T14:00:06Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical"}],"cwes":["CWE-287"],"updated_at":"2026-11-02T14:39:01.677422Z"}],"nvd":[{"id":"CVE-2025-61922","description":"PrestaShop Checkout is the PrestaShop official payment module in partnership with PayPal. Starting in version 1.3.0 and prior to versions 4.4.1 and 5.0.5, missing validation on the Express Checkout feature allows silent login, enabling account takeover via email. The vulnerability is fixed in versions 4.4.1 and 5.0.5. No known workarounds exist.","status":"published","published":"2025-10-16T18:15:38.597Z","modified":"2026-10-09T10:10:00.193Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical","assessor":"secondary"}],"cwes":["CWE-287"],"updated_at":"2026-11-02T14:11:39.069866Z"}],"osv":[{"id":"CVE-2025-61922","title":"PrestaShop Checkout allows customer account takeover via email","description":"PrestaShop Checkout is the PrestaShop official payment module in partnership with PayPal. Starting in version 1.3.0 and prior to versions 4.4.1 and 5.0.5, missing validation on the Express Checkout feature allows silent login, enabling account takeover via email. The vulnerability is fixed in versions 4.4.1 and 5.0.5. No known workarounds exist.","status":"published","published":"2025-10-16T17:26:14.999Z","modified":"2026-10-28T02:30:47.094178707Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical"}],"cwes":["CWE-287"],"updated_at":"2026-11-02T15:44:51.516975Z"},{"id":"GHSA-54hq-mf6h-48xh","title":"PrestaShop Checkout allows customer account takeover via email","description":"# Impact\nMissing validation on Express Checkout feature allows silent log-in\n\n## Affected versions\n\nThe issue was introduced in PrestaShop Checkout 1.3.0 .\n\nAll versions above 1.3.0 are vulnerable except of course the patch versions published on 16/10/2025: 7.4.4.1, 8.4.4.1, 7.5.0.5, 8.5.0.5, 9.5.0.5\n\n# Patches\nThe problem has been patched in versions\n\n- v4.4.1 for PrestaShop 1.7 (build number: 7.4.4.1)\n- v4.4.1 for PrestaShop 8 (build number: 8.4.4.1)\n- v5.0.5 for PrestaShop 1.7 (build number: 7.5.0.5)\n- v5.0.5 for PrestaShop 8 (build number: 8.5.0.5)\n- v5.0.5 for PrestaShop 9 (build number: 9.5.0.5)\n\nRead our [Versioning policy](https://github.com/PrestaShopCorp/ps_checkout/wiki/Versioning) to learn more about our build numbers and versions of PrestaShop Checkout\n\n# Credits\nWe would like to thank [Léo CUNÉAZ](https://github.com/inem0o) for reporting the issue.","status":"published","published":"2025-10-16T19:56:32Z","modified":"2025-10-17T14:21:05.562352Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical"}],"cwes":["CWE-287"],"updated_at":"2026-11-02T15:46:37.864461Z"}]}}