The Paymenter checkout component improperly filters URL-writable properties, exposing the $checkoutConfig property to URL query parameters. Validation is only applied to keys explicitly defined by extensions, allowing undefined keys to bypass validation. These unchecked keys are stored directly in the database and later used during server provisioning, where user-supplied values override administrator-defined configurations. This flaw enables authenticated users to manipulate server resource limits and hosting plans at checkout without special privileges.

Authenticated users can remotely manipulate server provisioning parameters, overriding core resource limits such as CPU, RAM, storage, or package tiers. This can lead to unauthorized resource allocation and potential abuse of hosting services. No administrative privileges are required to exploit this vulnerability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the checkout component to trusted users and monitor for unusual provisioning activity. Review and harden validation and sanitation of URL parameters in the checkout process to prevent injection of arbitrary keys.