CVE-2025-61924: PrestaShop Checkout Target PayPal merchant account hijacking from backoffice
Impact Wrong usage of the PHP arraysearch() allows bypass of validation.
Patches The problem has been patched in versions: - v4.4.1 for PrestaShop 1.7 (build number: 7.4.4.1) - v4.4.1 for PrestaShop 8 (build number: 8.4.4.1) - v5.0.5 for PrestaShop 1.7 (build number: 7.5.0.5) - v5.0.5 for PrestaShop 8 (build number: 8.5.0.5) - v5.0.5 for PrestaShop 9 (build number: 9.5.0.5)
Read the Versioning policy to learn more about the build number.
Credits Léo CUNÉAZ reported this issue.
Other sources
PrestaShop Checkout is the PrestaShop official payment module in partnership with PayPal. In versions prior to 4.4.1 and 5.0.5, the Target PayPal merchant account hijacking from backoffice due to wrong usage of the PHP arraysearch(). The vulnerability is fixed in versions 4.4.1 and 5.0.5. No known workarounds exist.
— MITRE
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-61924?
CVE-2025-61924 is classified as a high severity vulnerability due to the potential for merchant account hijacking.
How do I fix CVE-2025-61924?
To fix CVE-2025-61924, update your PrestaShop Checkout module to version 4.4.1 or higher, or 5.0.5 or higher.
Which versions of PrestaShop Checkout are affected by CVE-2025-61924?
CVE-2025-61924 affects PrestaShop Checkout versions prior to 4.4.1 and 5.0.5.
What impact does CVE-2025-61924 have on my PrestaShop store?
CVE-2025-61924 can allow attackers to hijack the PayPal merchant account associated with the PrestaShop store's backoffice.
Is there a workaround for CVE-2025-61924 if I cannot update immediately?
There are no known workarounds for CVE-2025-61924; updating to the fixed version is strongly recommended.