Paymenter, a free and open‑source webshop platform, has a flaw in its checkout component where URL‑writable properties are inadequately filtered. Authenticated users can inject arbitrary key‑value pairs into the $checkoutConfig property via the query string; because the bundled server extensions prioritize user‑supplied values over administrator‑defined settings, these injected keys can override core provisioning parameters such as CPU, RAM, storage, or package tier. The injected data is stored directly in the database by the cart component and later passed to server extensions during provisioning, effectively letting a regular user bypass paid plan limits and consume resources beyond the intended allocation without any administrative privileges. No higher privileges are required to exploit this vulnerability. This flaw involves improper input validation (CWE‑20) and unauthorized manipulation of configuration data (CWE‑639). The issue is fixed in version 1.5.1.

Only the Paymenter application – version 1.5.0 and earlier – is affected. The vulnerability is fixed in Paymenter 1.5.1 and later releases, so any installation running an earlier tag is at risk. No other vendors or products are impacted according to the CNA.

With a CVSS score of 8.5, the vulnerability is considered high severity. The EPSS score of less than 1% indicates a very low exploitation probability, but the lack of a KEV listing does not diminish the risk because the flaw can be exploited remotely by any authenticated user. Since no administrative rights are required, the attack vector is relatively easy: an attacker logs into the storefront, reaches the checkout page, appends malicious query parameters, and the system persists these overrides to the database and propagates them during provisioning, effectively granting the attacker a higher resource tier. The combination of a high CVSS score, easy authentication requirement, and the ability to change core provisioning settings places this issue in a high priority category for rapid remediation.