CVE-2026-119749: GetPaid WordPress Plugin < 2.8.63 Negative Quantity Payment Bypass
The GetPaid plugin for WordPress before 2.8.63 contains an improper input validation vulnerability that allows unauthenticated attackers to bypass payment processing by submitting a negative item quantity on a public payment form. Attackers can exploit the unchecked quantity value in processitem() to produce a negative line subtotal that reduces the invoice total to zero, causing processfreepayment() to mark the invoice as paid without any actual gateway charge.
Event History
Frequently Asked Questions
Who is exposed to this issue?
Sites using a GetPaid version before 2.8.63 are exposed where attackers can submit a public payment form. No account or prior authentication is required.
What does an attacker need to do to bypass payment processing?
An attacker submits a negative item quantity through a public payment form. The unchecked value can create a negative line subtotal, reduce the invoice total to zero, and cause the invoice to be marked paid without a gateway charge.
Are payment gateway credentials or a successful gateway transaction required?
No. The affected flow invokes free-payment processing after the manipulated quantity reduces the invoice total to zero, so no actual gateway charge occurs.
How can I tell whether a payment may have been bypassed?
Review paid invoices for zero totals and line items with negative quantities or negative subtotals. These conditions match the input manipulation described for the affected processing flow.