PrestaShop Checkout CVE-2025-61922

Requires the store to be running PrestaShop Checkout (ps_checkout) at a vulnerable version (introduced in 1.3.0; all versions up to the 16/10/2025 fixes are vulnerable except 4.4.1/5.0.5) WITH the Express Checkout feature in use - the silent-login bypass is reached through that specific feature. Per CVSS PR:N/UI:N the attack is remote and unauthenticated and needs no victim interaction. The primary limiting factor is deployment scope: only PrestaShop merchants who have installed this PayPal-partner module and enabled Express Checkout are exposed; stores on patched builds (7.4.4.1, 8.4.4.1, 7.5.0.5, 8.5.0.5, 9.5.0.5) or not using the module are not. No workarounds exist, so the condition is remediated only by upgrading.

This is a genuinely high-priority flaw for the specific population that runs it. The CVSS 9.1 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N) describes a network-reachable, low-complexity, unauthenticated attack with high confidentiality and integrity impact - fully consistent with a CWE-287 authentication bypass that yields customer account takeover, so the vector and the description do not conflict. The GitHub Security Advisory (GHSA-54hq-mf6h-48xh) and NVD confirm the defect and a vendor patch, giving high confidence in the technical facts. However, the real-world-urgency signals are more measured: there is no CISA KEV listing and no public exploit code identified at time of analysis, and the EPSS score is low at 0.50% (41st percentile), indicating no observed mass-exploitation activity yet. The gap between the high CVSS and the low EPSS is expected for a freshly disclosed (patched 16/10/2025) auth-bypass in a single e-commerce payment module rather than a contradiction: impact is severe per-victim but the attack surface is confined to stores running the vulnerable ps_checkout versions. Net: treat as an urgent patch for affected PrestaShop merchants (account takeover = direct customer-data and fraud exposure) while recognizing current exploitation is not confirmed widespread.

A remote, unauthenticated attacker abuses the Express Checkout flow on a PrestaShop store running ps_checkout, submitting a target victim's email address so that the missing validation triggers a silent log-in into that customer's account. The attacker then controls the victim's account - viewing stored personal data, order history, and saved addresses, and potentially placing or manipulating orders. No public exploit code has been identified at time of analysis, and no user interaction by the victim is required.