CVE-2025-61924 PrestaShop Checkout Target PayPal merchant account hijacking from backoffice
An attacker with backoffice access can hijack the target PayPal merchant account due to flawed logic in the PrestaShop Checkout module.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-61924?
CVE-2025-61924 is a low-severity vulnerability in PrestaShopCorp ps_checkout, published on 16 Oct 2025. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
PrestaShop Checkout is the PrestaShop official payment module in partnership with PayPal. In versions prior to 4.4.1 and 5.0.5, the Target PayPal merchant account hijacking from backoffice due to wrong usage of the PHP array_search(). The vulnerability is fixed in versions 4.4.1 and 5.0.5. No known workarounds exist.
Weakness: CWE-184
Which versions are affected by CVE-2025-61924?
4 open source packages ship an affected version, including prestashop/ps_checkout. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
prestashop/ps_checkout Packagist | All versions | 4.4.1 |
prestashop/ps_checkout Packagist | All versions | 4.4.1 |
prestashop/ps_checkout Packagist | From 5.0.0 | 5.0.5 |
prestashop/ps_checkout Packagist | From 5.0.0 | 5.0.5 |
Products include Prestashop Prestashop Checkout.
How do I fix CVE-2025-61924?
Upgrade prestashop/ps_checkout to a fixed version for your release line: 4.4.1 or 5.0.5.
Is CVE-2025-61924 being exploited?
There is no known exploitation of CVE-2025-61924 in the wild and no public exploit code.
Other vulnerabilities in PrestaShopCorp ps_checkout
Sources
Also known as GHSA-wvpg-4wrh-5889.