The vulnerability arises from an inadequate validation of the quantity field in the Paid Videochat Turnkey Site plugin. An attacker can supply arbitrary quantity values, leading to input data manipulation. This flaw could allow manipulation of payment amounts or resource allocation, potentially resulting in financial fraud, denial of service, or other unintended behavior.

The flaw affects VideoWhisper.com's Paid Videochat Turnkey Site plugin version 7.5.12 and earlier, including any builds labeled n/a through 7.5.12. Both WordPress site administrators and end users interacting with the plugin are potentially exposed.

The CVSS score of 4.3 indicates a moderate exploitation risk, and the EPSS score is not available, but the lack of a KEV listing implies no known widespread exploitation. The vulnerability is likely exploitable remotely via the web interface, as the quantity input is processed through HTTP requests. However, the exact attack vector is not explicitly stated in the advisory and is inferred from the plugin’s functionality.