Prestashop Checkout
Monthly
An authenticated attacker holding high-privilege PrestaShop backoffice access can hijack a store's Target PayPal merchant account through the official PrestaShop Checkout module (ps_checkout), because PHP's array_search() is used in a way that permits validation bypass. Affected installations are ps_checkout versions prior to 4.4.1 and versions 5.0.0 through 5.0.5, running on PrestaShop 1.7, 8, or 9. The issue requires backoffice privileges (CVSS vector PR:H) and no user interaction; no public exploit identified at time of analysis, EPSS is a low 0.27% (18th percentile), and the severity is assessed as low-priority despite the payment-account angle. Fixed builds 4.4.1 and 5.0.5 are available and no workarounds exist, so upgrading is the only mitigation.
Directory traversal in the PrestaShop Checkout (ps_checkout) module's backoffice input handling allows an authenticated administrator to read arbitrary files on the server, exposing configuration data, credentials, or other sensitive content outside the web root. The flaw affects ps_checkout versions prior to 4.4.1 on the 4.x branch and 5.0.0 through 5.0.4 on the 5.x branch, spanning PrestaShop 1.7, 8, and 9, and the assessed CVSS vector (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N) confirms that successful exploitation requires a high-privilege backoffice session. Vendor patches 4.4.1 and 5.0.5 are available, no workaround exists, and no public exploit code has been identified at time of analysis; the EPSS score of 0.92% (59th percentile) reflects a genuine but low-priority issue whose impact is bounded to read-only file disclosure with no integrity or availability effect.
Account takeover in the PrestaShop Checkout (ps_checkout) module allows unauthenticated remote attackers to silently log in as any customer through missing validation on the Express Checkout feature. The flaw was introduced in version 1.3.0 and affects all subsequent releases until the 16 October 2025 fixes: 4.4.1 on the 4.x line (builds 7.4.4.1 for PrestaShop 1.7 and 8.4.4.1 for PrestaShop 8) and 5.0.5 on the 5.x line (builds 7.5.0.5, 8.5.0.5, and 9.5.0.5 for PrestaShop 1.7, 8, and 9 respectively). CVSS 9.1 (AV:N/AC:L/PR:N/UI:N, C:H/I:H/A:N) reflects remote, unauthenticated, no-interaction exploitation limited to merchants who have installed this PayPal-partner payment module and enabled Express Checkout; EPSS is 0.50% (41st percentile) and no public exploit identified at time of analysis.
An authenticated attacker holding high-privilege PrestaShop backoffice access can hijack a store's Target PayPal merchant account through the official PrestaShop Checkout module (ps_checkout), because PHP's array_search() is used in a way that permits validation bypass. Affected installations are ps_checkout versions prior to 4.4.1 and versions 5.0.0 through 5.0.5, running on PrestaShop 1.7, 8, or 9. The issue requires backoffice privileges (CVSS vector PR:H) and no user interaction; no public exploit identified at time of analysis, EPSS is a low 0.27% (18th percentile), and the severity is assessed as low-priority despite the payment-account angle. Fixed builds 4.4.1 and 5.0.5 are available and no workarounds exist, so upgrading is the only mitigation.
Directory traversal in the PrestaShop Checkout (ps_checkout) module's backoffice input handling allows an authenticated administrator to read arbitrary files on the server, exposing configuration data, credentials, or other sensitive content outside the web root. The flaw affects ps_checkout versions prior to 4.4.1 on the 4.x branch and 5.0.0 through 5.0.4 on the 5.x branch, spanning PrestaShop 1.7, 8, and 9, and the assessed CVSS vector (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N) confirms that successful exploitation requires a high-privilege backoffice session. Vendor patches 4.4.1 and 5.0.5 are available, no workaround exists, and no public exploit code has been identified at time of analysis; the EPSS score of 0.92% (59th percentile) reflects a genuine but low-priority issue whose impact is bounded to read-only file disclosure with no integrity or availability effect.
Account takeover in the PrestaShop Checkout (ps_checkout) module allows unauthenticated remote attackers to silently log in as any customer through missing validation on the Express Checkout feature. The flaw was introduced in version 1.3.0 and affects all subsequent releases until the 16 October 2025 fixes: 4.4.1 on the 4.x line (builds 7.4.4.1 for PrestaShop 1.7 and 8.4.4.1 for PrestaShop 8) and 5.0.5 on the 5.x line (builds 7.5.0.5, 8.5.0.5, and 9.5.0.5 for PrestaShop 1.7, 8, and 9 respectively). CVSS 9.1 (AV:N/AC:L/PR:N/UI:N, C:H/I:H/A:N) reflects remote, unauthenticated, no-interaction exploitation limited to merchants who have installed this PayPal-partner payment module and enabled Express Checkout; EPSS is 0.50% (41st percentile) and no public exploit identified at time of analysis.