The GetPaid plugin for WordPress before 2.8.63 contains an authorization bypass vulnerability that allows unauthenticated attackers to access and manipulate another user's invoice by supplying its ID through the maybe_use_invoice parameter in process_invoice(), bypassing the ownership and key checks performed by is_authorized_to_pay(). Attackers can submit a known pending invoice ID via maybe_use_invoice to read checkout pricing details and initiate a checkout workflow, resulting in an unauthorized state change of the invoice to on-hold.
Metrics
Affected Vendors & Products
No data.
No data.
No data.
No data.
Advisories
No advisories yet.
Fixes
Solution
No solution given by the vendor.
Workaround
No workaround given by the vendor.
References
History
Wed, 04 Nov 2026 17:00:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | The GetPaid plugin for WordPress before 2.8.63 contains an authorization bypass vulnerability that allows unauthenticated attackers to access and manipulate another user's invoice by supplying its ID through the maybe_use_invoice parameter in process_invoice(), bypassing the ownership and key checks performed by is_authorized_to_pay(). Attackers can submit a known pending invoice ID via maybe_use_invoice to read checkout pricing details and initiate a checkout workflow, resulting in an unauthorized state change of the invoice to on-hold. | |
| Title | GetPaid WordPress Plugin < 2.8.63 Authorization Bypass via maybe_use_invoice | |
| Weaknesses | CWE-639 | |
| References |
| |
| Metrics |
cvssV3_1
|
Projects
Sign in to view the affected projects.
MITRE
Status: PUBLISHED
Assigner: VulnCheck
Published:
Updated: 2026-11-04T16:51:24.437Z
Reserved: 2026-10-30T15:31:52.079Z
Link: CVE-2026-119748
Vulnrichment
No data.
NVD
Status : Received
Published: 2026-11-04T17:17:34.770
Modified: 2026-11-04T17:17:34.770
Link: CVE-2026-119748
Redhat
No data.
OpenCVE Enrichment
No data.
Weaknesses