Improper validation of the specified quantity field in PayTR Virtual Pos iFrame API WHMCS Module allows an attacker to manipulate transaction amounts. Because the module does not enforce proper checks, a malicious user could submit altered quantity values, leading to unauthorized payment or revenue loss. This flaw is indexed as CWE‑1284, affecting transaction integrity and enabling financial fraud.

Systems that are impacted are PayTR Payment and Electronic Money Institution Inc.’s Virtual Pos iFrame API (v9x) WHMCS Module. Vulnerable versions include all releases starting with v9.0.0 up through, but not including, v9.0.3. Any WHMCS installation that uses these module versions is therefore at risk.

The CVSS score of 7.5 indicates high severity, and the EPSS score is less than 1%, so the likelihood of exploitation remains low. The vulnerability is not listed in the CISA KEV catalog. Based on the description, it is inferred that the attack vector involves sending manipulated quantity values through the PayTR API. An attacker would need access to the front‑end or a valid session to perform this manipulation, potentially resulting in financial loss by altering transaction amounts.