PrestaShop Checkout allows customer account takeover via email

CVE-2025-61922 describes a missing validation vulnerability in the Express Checkout feature of PrestaShop Checkout, the official payment module in partnership with PayPal. The flaw allows an attacker to silently log in as any user, effectively enabling account takeover via email. The issue was introduced in version 1.3.0 and affects all versions prior to 4.4.1 and 5.0.5 [1][3].

The attack requires no special authentication; the lack of validation on the Express Checkout flow means that an attacker can initiate a login using only a target email address. This bypasses normal authentication checks and grants unauthorized access to the victim's account. The vulnerability is particularly dangerous because it is silent—no additional verification is prompted [3].

Successful exploitation leads to full account takeover, allowing the attacker to access the victim's PrestaShop account, view personal information, and potentially make fraudulent transactions. The impact is severe as it compromises both user privacy and financial security [1][3].

The vulnerability has been patched in versions 4.4.1 and 5.0.5 of PrestaShop Checkout, corresponding to build numbers 7.4.4.1/8.4.4.1 for v4 and 7.5.0.5/8.5.0.5/9.5.0.5 for v5. No workarounds are available; users must upgrade to the fixed versions [3].