CVE-2026-97275: Improper Validation of Specified Quantity in Input in VillaTheme BuildKit – Product Builder for WooCommerce – Custom PC Builder

The vulnerability identified as CVE-2026-97275 concerns improper validation of specified quantity input in the VillaTheme BuildKit – Product Builder for WooCommerce – Custom PC Builder plugin. This flaw allows an attacker to manipulate input data related to product quantities. The affected versions include all releases from the initial version up to and including 1.0.28. The CVSS 3.1 base score is 5.3, indicating a medium severity with network attack vector, low attack complexity, no privileges required, no user interaction, unchanged scope, no confidentiality impact, limited integrity impact, and no availability impact.

The vulnerability allows an attacker to manipulate input data related to product quantities, which could lead to integrity issues such as incorrect order quantities being processed. There is no impact on confidentiality or availability. The attack can be performed remotely without authentication or user interaction.

No patch or official fix information is provided in the available data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should monitor vendor communications for updates and consider implementing input validation controls if possible.