Improper validation of the quantity field in Convers Lab's WP SmartPay plugin allows an attacker to supply an arbitrary quantity value, causing the calculated payment amount to differ from the intended price. This flaw can lead to financial loss or revenue leakage for site owners and can also undermine customer trust. The weakness is related to the input validation subclass that fails to enforce correct boundaries for user‑supplied numeric data.

Convers Lab:WP SmartPay is affected, with the vulnerability present in all product releases up to and including version 2.8.2. No other versions or products are listed as affected.

The CVSS score of 7.5 indicates high severity, but the EPSS score of less than 1% reflects a low estimated probability of exploitation at present. The vulnerability is not listed in CISA’s KEV catalog, so there is no indication of active exploitation. Attackers would likely exploit the flaw through normal use of the purchase flow or by forging requests to the payment form; no privileged access or unusual conditions are mentioned in the description.