The vulnerability arises from improper validation of the quantity field in the Woo Product Builder plugin. Attackers can supply an altered value, enabling them to set arbitrary quantities for items in the custom PC builder form. The weakness aligns with CWE-1284, indicating improper validation of input data.

The issue impacts the VillaTheme BuildKit – Product Builder for WooCommerce – Custom PC Builder plugin, versions up to and including 1.0.28. Any WordPress site using this plugin before the 1.0.29 release is potentially exposed.

The CVSS score of 5.3 indicates moderate severity. No EPSS score is available, and the vulnerability is not listed in CISA's KEV catalog, suggesting limited known exploitation. The likely attack vector is inferred to be through the public-facing quantity input on the custom PC builder page – a user can craft a request with manipulated values. Since the plugin relies on untrusted input to compute order details, exploitation requires access to user input and can be achieved via normal user interactions or crafted HTTP requests.