CVE-2026-119748
GetPaid WordPress Plugin < 2.8.63 Authorization Bypass via maybe_use_invoice
CVSS Score
6.5
EPSS Score
0.0%
EPSS Percentile
0th
The GetPaid plugin for WordPress before 2.8.63 contains an authorization bypass vulnerability that allows unauthenticated attackers to access and manipulate another user's invoice by supplying its ID through the maybe_use_invoice parameter in process_invoice(), bypassing the ownership and key checks performed by is_authorized_to_pay(). Attackers can submit a known pending invoice ID via maybe_use_invoice to read checkout pricing details and initiate a checkout workflow, resulting in an unauthorized state change of the invoice to on-hold.
| CWE | CWE-639 |
| Vendor | ayecode ltd |
| Product | payment forms, buy now buttons, and invoicing system | getpaid |
| Published | Nov 4, 2026 |
| Last Updated | Nov 4, 2026 |
Stay Ahead of the Next One
Get instant alerts for ayecode ltd payment forms, buy now buttons, and invoicing system | getpaid
Be the first to know when new medium vulnerabilities affecting ayecode ltd payment forms, buy now buttons, and invoicing system | getpaid are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
Low
Integrity
Low
Availability
None
Affected Versions
AyeCode Ltd / Payment forms, Buy now buttons, and Invoicing System | GetPaid
0 < 2.8.63
References
Credits
🔍 Idan Malihi