CVE-2026-47198: Paymenter input validation bypass in checkout component

CVE-2026-47198 · Severity: high · CVSS 8.5 · Published 2026-07-20

Paymenter is an open-source platform used to manage and sell hosting services. A security flaw in the checkout process allows customers to bypass resource limits and plan restrictions by modifying web address parameters. This means a user could potentially purchase a high-end server (with more CPU, RAM, or storage) while only paying for a basic plan, leading to financial loss and resource abuse for the hosting provider.

Technologies: paymenter/paymenter (Packagist), Paymenter. Vendors: Packagist, Paymenter.

Quick answers

Is CVE-2026-47198 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-47198 being exploited in the wild.
How severe is CVE-2026-47198?
High severity, with a CVSS score of 8.5, published 20 July 2026.
Which products and versions are affected?
paymenter/paymenter (Packagist) < 1.5.1, ECOSYSTEM:introduced=0,fixed=1.5.1; Paymenter < 1.5.1.
Is there a fix for CVE-2026-47198?
Yes. paymenter/paymenter (Packagist): upgrade to 1.5.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-47198 attacked?
It is attacked over the network, in a web application.
Am I affected by CVE-2026-47198?
Check whether you run paymenter/paymenter (Packagist) or Paymenter at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • paymenter/paymenter (Packagist): upgrade to 1.5.1 or later
    composer require paymenter/paymenter:^1.5.1

Technical details

The vulnerability exists in the Checkout Livewire component (app/Livewire/Products/Checkout.php), where the $checkoutConfig property is exposed via URL query parameters using the #[Url] attribute. Validation rules are only dynamically generated for keys explicitly defined by an extension's getCheckoutConfig() method, allowing any undefined injected keys to bypass validation entirely. These unsanitized keys are stored in the database by the cart component and subsequently passed to server extensions during provisioning. Because server extensions prioritize these user-supplied properties, an authenticated attacker can override core resource limits such as CPU, RAM, and storage tiers. This issue is fixed in version 1.5.1.

Affected products

  • Paymenter Paymenter < 1.5.1

Identifiers

  • CVE-2026-47198
  • GHSA-5q4q-834j-g8g4

Timeline

  • 2026-06-30: advisory: GitHub security advisory published by maintainers
  • 2026-07-20: disclosed: CVE-2026-47198 published to NVD

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.