CVE Explorer
CVE-2025-61924
PrestaShop Checkout is the PrestaShop official payment module in partnership with PayPal. In versions prior to 4.4.1 and 5.0.5, the Target PayPal merchant account hijacking from backoffice due to wrong usage of the PHP array_search(). The vulnerability is fixed in versions 4.4.1 and 5.0.5. No known workarounds exist.
Known exploited
Not asserted
Disputed
No
Stale source
No
Conflicts
0
Affected products and versions
1 source assertion{"product":"ps_checkout","vendor":"PrestaShopCorp","versions":[{"status":"affected","version":"< 4.4.1"},{"status":"affected","version":">= 5.0.0, < 5.0.5"}]}
- cve_program_cvelist_v5affectedurn:baitaphish:normalized-source-record:v2:bb7dd0f141fecabb8cace45a9518cdb3ed9bbcc1eac4c5d1f5352def87035870 · sha256:6782234447cad75d… · /containers/cna/affected/0
Provider-owned CVSS observations
1 source assertion{"metric":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":3.8,"baseSeverity":"LOW","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N","version":"3.1"},"metric_type":"cvssV3_1"}
- cve_program_cvelist_v5cvssurn:baitaphish:normalized-source-record:v2:bb7dd0f141fecabb8cace45a9518cdb3ed9bbcc1eac4c5d1f5352def87035870 · sha256:6782234447cad75d… · /containers/cna/metrics/0/cvssV3_1
CWE assertions
1 source assertion{"cweId":"CWE-184","description":"CWE-184: Incomplete List of Disallowed Inputs","lang":"en","type":"CWE"}
- cve_program_cvelist_v5cweurn:baitaphish:normalized-source-record:v2:bb7dd0f141fecabb8cace45a9518cdb3ed9bbcc1eac4c5d1f5352def87035870 · sha256:6782234447cad75d… · /containers/cna/problemTypes/0/descriptions/0
Source references
1 source assertion{"name":"https://github.com/PrestaShopCorp/ps_checkout/security/advisories/GHSA-wvpg-4wrh-5889","tags":["x_refsource_CONFIRM"],"url":"https://github.com/PrestaShopCorp/ps_checkout/security/advisories/GHSA-wvpg-4wrh-5889"}
- cve_program_cvelist_v5referenceurn:baitaphish:normalized-source-record:v2:bb7dd0f141fecabb8cace45a9518cdb3ed9bbcc1eac4c5d1f5352def87035870 · sha256:6782234447cad75d… · /containers/cna/references/0
Attribution and limitations
- CVE Program CVEList V5: Reproduce the MITRE copyright designation and CVE license in copies. Source →
Provider severity values are preserved separately. Baitaphish does not convert them into a risk rating, infer affected products, or treat EPSS as observed exploitation.