CVE-2025-61922 PrestaShop Checkout allows customer account takeover via email
Attackers can take over customer accounts via email due to missing validation in the Express Checkout feature of the PrestaShop Checkout module.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-61922?
CVE-2025-61922 is a critical authentication bypass vulnerability in PrestaShopCorp ps_checkout, published on 16 Oct 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
PrestaShop Checkout is the PrestaShop official payment module in partnership with PayPal. Starting in version 1.3.0 and prior to versions 4.4.1 and 5.0.5, missing validation on the Express Checkout feature allows silent login, enabling account takeover via email. The vulnerability is fixed in versions 4.4.1 and 5.0.5. No known workarounds exist.
Weakness: CWE-287
Which versions are affected by CVE-2025-61922?
4 open source packages ship an affected version, including prestashop/ps_checkout. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
prestashop/ps_checkout Packagist | From 1.3.0 | 4.4.1 |
prestashop/ps_checkout Packagist | From 1.3.0 | 4.4.1 |
prestashop/ps_checkout Packagist | From 5.0.0 | 5.0.5 |
prestashop/ps_checkout Packagist | From 5.0.0 | 5.0.5 |
Products include Prestashop Prestashop Checkout.
How do I fix CVE-2025-61922?
Upgrade prestashop/ps_checkout to a fixed version for your release line: 4.4.1 or 5.0.5.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2025-61922 being exploited?
There is no known exploitation of CVE-2025-61922 in the wild and no public exploit code.
Public exploit code: 2 proofs of concept on GitHub.
Other vulnerabilities in PrestaShopCorp ps_checkout
Sources
Also known as GHSA-54hq-mf6h-48xh.