VulnerabilityAnalyzed

CVE-2025-61924

The vulnerability is fixed in versions 4.4.1 and 5.0.5.

LOW 3.8EPSS 0.25%

Does this matter?

Lower severity and a low EPSS score (0.25%). Track it; it rarely justifies an emergency change on its own.

Description

PrestaShop Checkout is the PrestaShop official payment module in partnership with PayPal. In versions prior to 4.4.1 and 5.0.5, the Target PayPal merchant account hijacking from backoffice due to wrong usage of the PHP array_search(). The vulnerability is fixed in versions 4.4.1 and 5.0.5. No known workarounds exist.

CVSS 3.1: 3.8 LOWCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N
EPSS: 0.25% probability · 17th percentile
CISA KEV: Not listed
Weakness: CWE-184
Affected: prestashop/prestashop checkout
Source: security-advisories@github.com

References

https://github.com/PrestaShopCorp/ps_checkout/security/advisories/GHSA-wvpg-4wrh-5889Vendor Advisory

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.