CVE-2026-119748: GetPaid WordPress Plugin < 2.8.63 Authorization Bypass via maybe_use_invoice
The GetPaid plugin for WordPress before 2.8.63 contains an authorization bypass vulnerability that allows unauthenticated attackers to access and manipulate another user's invoice by supplying its ID through the maybeuseinvoice parameter in processinvoice(), bypassing the ownership and key checks performed by isauthorizedtopay(). Attackers can submit a known pending invoice ID via maybeuseinvoice to read checkout pricing details and initiate a checkout workflow, resulting in an unauthorized state change of the invoice to on-hold.
Event History
Frequently Asked Questions
Who is exposed to this issue?
Sites running the GetPaid WordPress plugin before version 2.8.63 are affected. An attacker does not need an account or prior authentication.
What does an attacker need to exploit it?
The attacker needs to know a pending invoice ID and submit it through the maybe_use_invoice parameter in process_invoice(). No user interaction or elevated privileges are required.
What can an attacker do with a targeted invoice?
An attacker can access checkout pricing details, initiate the invoice checkout workflow, and cause the invoice state to change to on-hold. The issue bypasses the normal ownership and key checks for invoice payment authorization.
How can I determine whether an invoice may have been targeted?
Review pending invoices for unexpected transitions to the on-hold state and investigate checkout activity associated with those invoices. The provided information does not identify any additional logging indicators.