Missing validation on Express Checkout feature in the PrestaShop Checkout module allows silent log-in, enabling customer account takeover via email.

Summary

Description

The issue was introduced in PrestaShop Checkout 1.3.0. A missing validation on the Express Checkout feature allows attackers to perform silent authentication, leading to customer account takeover via email. All versions above 1.3.0 are vulnerable except the patched versions.

Important note about version numbering: The first digit of the version displayed in the PrestaShop back office corresponds to the PrestaShop version. Therefore:

  • For PrestaShop 1.7: versions < 7.5.0.5 require an update
  • For PrestaShop 8: versions < 8.5.0.5 require an update
  • For PrestaShop 9: versions < 9.5.0.5 require an update

CVSS base metrics

  • Attack vector: network
  • Attack complexity: low
  • Privilege required: none
  • User interaction: none
  • Scope: unchanged
  • Confidentiality: high
  • Integrity: high
  • Availability: none

Vector string: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Possible malicious usage

  • Customer account takeover
  • Unauthorized order placement using compromised accounts

Patches

The problem has been patched in the following versions published on 2025-10-16:

  • v4.4.1 for PrestaShop 1.7 (build number: 7.4.4.1)
  • v4.4.1 for PrestaShop 8 (build number: 8.4.4.1)
  • v5.0.5 for PrestaShop 1.7 (build number: 7.5.0.5)
  • v5.0.5 for PrestaShop 8 (build number: 8.5.0.5)
  • v5.0.5 for PrestaShop 9 (build number: 9.5.0.5)

Read the PrestaShop Checkout Versioning policy to learn more about build numbers and versions.

Other recommendations

  • It’s highly recommended to upgrade the module to the latest patched version immediately.
  • Review your logs for any suspicious authentication activities
  • Consider notifying affected customers if you suspect account compromise
  • Monitor for unusual order or account activity patterns

Timeline

Date Action
2025-10-16 Vulnerability patched and versions released
2025-10-16 Publication of this security advisory

Credits

We would like to thank Léo CUNÉAZ for reporting the issue.