Executive brief
Paymenter is an open-source platform used to manage and sell hosting services. A security flaw in the checkout process allows customers to bypass resource limits and plan restrictions by modifying web address parameters. This means a user could potentially purchase a high-end server (with more CPU, RAM, or storage) while only paying for a basic plan, leading to financial loss and resource abuse for the hosting provider.
Technical details
The vulnerability exists in the Checkout Livewire component (app/Livewire/Products/Checkout.php), where the $checkoutConfig property is exposed via URL query parameters using the #[Url] attribute. Validation rules are only dynamically generated for keys explicitly defined by an extension's getCheckoutConfig() method, allowing any undefined injected keys to bypass validation entirely. These unsanitized keys are stored in the database by the cart component and subsequently passed to server extensions during provisioning. Because server extensions prioritize these user-supplied properties, an authenticated attacker can override core resource limits such as CPU, RAM, and storage tiers. This issue is fixed in version 1.5.1.
Affected products
- Paymenter Paymenter < 1.5.1
Timeline
- 2026-06-30: advisory: GitHub security advisory published by maintainers
- 2026-07-20: disclosed: CVE-2026-47198 published to NVD