Paymenter is a free and open-source webshop solution for management of hosting services. In versions prior to 1.5.0, the email update functionality fails to invalidate the existing verification state when a user changes their email address, allowing a verified account to retain its verified status after switching to an unverified or unowned email address. After a user updates their email address, the system does not reset or re‑validate the associated email verification status; the verification column remains set to “true” even after the email address was changed. Exploitation could potentially result in misrepresentation of email ownership, bypass of verification‑based trust assumptions, and abuse of features gated behind verified status. No direct unauthorized access to other users’ accounts or data is possible through this issue alone. This flaw corresponds to CWE‑345 (Verification state tampering) and permits a user to continue to benefit from functionality that relies on the verified flag, potentially leading to unintended feature usage or elevated trust.

The vulnerability affects the Paymenter webshop platform. Any instance running Paymenter before version 1.5.0 is impacted, as those releases fail to reset or re‑verify the email verification status when a user changes their address.

The vulnerability, scored 4.3 on CVSS, represents low‑to‑moderate severity. The EPSS indicates a low probability (<1%) and it is not listed in CISA's KEV catalog, suggesting limited real‑world exploitation. The attack requires a legitimate user who can change their own email address; the system does not reset or re‑verify the email after the change. Consequently, the attacker can continue to benefit from any functionality that relies on the verified flag, leading to unintended feature usage or elevated trust. No escalation beyond the account is possible, and no direct access to other accounts or data is granted. The issue is strictly about data integrity and trust assumptions rather than privilege escalation.