GHSA-mqq7-wxx5-mp8h

Suggest an improvement
Source
https://github.com/advisories/GHSA-mqq7-wxx5-mp8h
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/04/GHSA-mqq7-wxx5-mp8h/GHSA-mqq7-wxx5-mp8h.json
JSON Data
https://api.osv.dev/v1/vulns/GHSA-mqq7-wxx5-mp8h
Published
2026-04-30T20:59:28Z
Modified
2026-09-10T03:50:44Z
Severity
  • 2.7 (Low) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:U CVSS Calculator
Summary
ps_checkout allows unauthorized method invocation through unvalidated parameter
Details

Impact

Unvalidated parameter can lead to some unauthorized method invocation with very little possibilities.

Patches

The problem has been patched in versions

  • v5.3.0 for PrestaShop 1.7 (build number: 7.5.3.0)
  • v5.3.0 for PrestaShop 8 (build number: 8.5.3.0)
  • v5.3.0 for PrestaShop 9 (build number: 9.5.3.0)

Read the Versioning policy to learn more about the build numbers.

Credits

PrestaShop thanks PATICEO for reporting the issue.

Database specific 
{
    "cwe_ids":  [
        "CWE-20"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2026-04-30T20:59:28Z",
    "nvd_published_at":  null,
    "severity":  "LOW"
}
References

Affected packages

Packagist / prestashop/ps_checkout

Package

Name
prestashop/ps_checkout
Purl
pkg:composer/prestashop/ps_checkout

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
5.3.0

Affected versions

v1.*
v1.0.1
v1.0.2
v1.0.3
v1.0.4
v1.0.5
v1.0.6
v1.0.7
v1.0.8
v1.0.9
v1.1.1
v1.1.2
v1.1.3
v1.1.4
v1.1.5
v1.1.6
v1.1.7
v1.1.8
v1.2
v1.2.1
v1.2.2
v1.2.3
v1.2.5
v1.2.6-beta.1
v1.2.6
v1.2.7-beta.1
v1.2.7-beta.2
v1.2.7
v1.2.8
v1.2.9
v1.2.10-beta.1
v1.2.10-beta.2
v1.2.10-beta.3
v1.2.10-beta.4
v1.2.10
v1.2.11
v1.2.12-beta.1
v1.2.12
v1.2.13
v1.2.14-beta.1
v1.2.14-beta.2
v1.3.0-beta.1
v1.3.0-beta.2
v1.3.0
v1.4.0
v1.4.1
v1.5.0
v1.5.1
v1.5.2
v2.*
v2.0.0
v2.0.1
v2.0.2
v2.0.3
v2.0.4
v2.0.5
v2.0.7
v2.0.8
v2.1.0
v2.2.0
v2.3.0
v2.4.0
v2.5.0
v2.5.1
v2.5.2
v2.6.0
v2.7.0
v2.7.1
v2.8.0
v2.9.0
v2.10.0
v2.11.0
v2.12.0
v2.12.1
v2.13.0
v2.14.0
v2.15.0
v2.15.1
v2.15.2
v2.15.3
v2.15.4
v2.15.5
v2.16.0
v2.17.0
v2.17.1
v2.18.0
v2.18.1
v2.19.0
v2.20.0
v2.20.1
v2.20.2
v2.21.0
v3.*
v3.0.0
v3.0.1
v3.0.2
v5.*
v5.0.1
v5.0.2
v5.0.3
v5.0.4-beta1
v5.0.4-beta2
v5.0.4-beta3
v5.0.4-beta4
v5.0.4-beta5
v5.0.4-beta6
v5.0.4-beta7
v5.0.4-beta8
v5.0.4-beta9
v5.0.4-beta10
v5.0.4
v5.0.5
v5.0.6
v5.0.7
v5.1.0
v5.1.1
v5.2.0

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/04/GHSA-mqq7-wxx5-mp8h/GHSA-mqq7-wxx5-mp8h.json"