GHSA-mqq7-wxx5-mp8h ps_checkout allows unauthorized method invocation through unvalidated parameter
An unvalidated parameter in the PrestaShop checkout plugin allows unauthorized method invocation, potentially bypassing security controls.
- Exploited in the wild
- Not known
- Login needed
- Not stated
- Attackable
- Over the internet
- Victim action needed
- Not stated
- Fix
- Available
What is GHSA-mqq7-wxx5-mp8h?
GHSA-mqq7-wxx5-mp8h is a missing authorization vulnerability in prestashop/ps_checkout, published on 30 Apr 2026. It can be exploited over the network.
Official description
Impact
Unvalidated parameter can lead to some unauthorized method invocation with very little possibilities.
Patches
The problem has been patched in versions
- v5.3.0 for PrestaShop 1.7 (build number: 7.5.3.0)
- v5.3.0 for PrestaShop 8 (build number: 8.5.3.0)
- v5.3.0 for PrestaShop 9 (build number: 9.5.3.0)
Read the Versioning policy to learn more about the build numbers.
Credits
PrestaShop thanks PATICEO for reporting the issue.
Which versions are affected by GHSA-mqq7-wxx5-mp8h?
2 open source packages ship an affected version, including prestashop/ps_checkout.
| Package | Affected | Fixed in |
|---|---|---|
prestashop/ps_checkout Packagist | All versions | 5.3.0 |
prestashop/ps_checkout Packagist | All versions | 5.3.0 |
How do I fix GHSA-mqq7-wxx5-mp8h?
Upgrade prestashop/ps_checkout to 5.3.0 or later.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is GHSA-mqq7-wxx5-mp8h being exploited?
There is no known exploitation of GHSA-mqq7-wxx5-mp8h in the wild and no public exploit code.