Description
PrestaShop Checkout is the PrestaShop official payment module in partnership with PayPal. Starting in version 1.3.0 and prior to versions 4.4.1 and 5.0.5, missing validation on the Express Checkout feature allows silent login, enabling account takeover via email. The vulnerability is fixed in versions 4.4.1 and 5.0.5. No known workarounds exist.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| PrestaShopCorp | ps_checkout | >= 1.3.0, < 4.4.1, >= 5.0.0, < 5.0.5 | — |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
GitHub 2 repositories
-
g0vguy/CVE-2025-61922-PoC ★ 11 · Jan 2, 2026
A simple, educational proof-of-concept script demonstrating the zero-click account takeover vulnerability in the PrestaShop Checkout module (CVE-2025-61922).
-
captaincookie34/Vulnerability-Playground-CVE-2025-61922 ★ 0 · Nov 8, 2025
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Packagist | prestashop/ps_checkout | >= 1.3.0, < 4.4.1 | 4.4.1 | GHSA-54hq-mf6h-48xh |
| Packagist | prestashop/ps_checkout | >= 5.0.0, < 5.0.5 | 5.0.5 | GHSA-54hq-mf6h-48xh |