URL Injection Vulnerability in Paymenter by Paymenter
CVE-2026-47198

8.5HIGH

Key Information:

Vendor

Paymenter

Status
Paymenter
Vendor
CVE Published:
20 July 2026

What is CVE-2026-47198?

The vulnerability within Paymenter stems from the checkout component's failure to adequately filter URL-writable properties. This allows authenticated users to inject arbitrary key-value pairs during server provisioning. Consequently, user-supplied properties take precedence over administrator-defined configurations, enabling regular users to manipulate hosting plans and resource limits without needing elevated privileges. The Livewire component exposes the $checkoutConfig property via URL query parameters, validating only explicitly defined keys, which creates a loophole for undefined keys to bypass validation. Unsanitized keys are stored directly in the database and can lead to unauthorized overrides of essential resource limits like CPU, RAM, and storage. This vulnerability impacts the fundamental operation of the hosting service management system. The issue has been addressed in version 1.5.1.

Affected Version(s)

Paymenter < 1.5.1

References

https://github.com/Paymenter/Paymenter/security/advisorie...
x_refsource_CONFIRM

CVSS V3.1

Score:
8.5
Severity:
HIGH
Confidentiality:
None
Integrity:
High
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.