CVE-2026-123668: GetPaid 2.8.63 - 2.8.64 - Unauthenticated Payment Bypass via Fractional Item Quantity

Q: Who is exposed to this issue?

Sites using the GetPaid WordPress plugin in versions 2.8.63 through 2.8.64 are affected if they use its payment forms for priced invoice items.

Q: What does an attacker need to exploit it?

Exploitation is unauthenticated and requires no user interaction. An attacker can submit a fractional item quantity through a payment form.

Q: What is the practical impact of successful exploitation?

A priced invoice item can be marked as paid without the attacker being charged. The reported impact is integrity-only; no confidentiality or availability impact is specified.

Published Nov 11, 2026

Updated

The GetPaid WordPress plugin from 2.8.63 to 2.8.64 does not ensure item quantities on its payment forms are whole numbers, allowing unauthenticated users to have an invoice for a priced item marked as paid without being charged.

Affected Software

1 affected component

GetPaid GetPaid WordPress plugin>=2.8.63<=2.8.64

Event History

Nov 11, 2026

CVE Published

via MITRE·07:33 AM

Data Sourced

via MITRE·07:33 AM

DescriptionSeverityWeakness

Frequently Asked Questions

Who is exposed to this issue?

Sites using the GetPaid WordPress plugin in versions 2.8.63 through 2.8.64 are affected if they use its payment forms for priced invoice items.

What does an attacker need to exploit it?

Exploitation is unauthenticated and requires no user interaction. An attacker can submit a fractional item quantity through a payment form.

What is the practical impact of successful exploitation?

A priced invoice item can be marked as paid without the attacker being charged. The reported impact is integrity-only; no confidentiality or availability impact is specified.

CVE-2026-123668: GetPaid 2.8.63 - 2.8.64 - Unauthenticated Payment Bypass via Fractional Item Quantity

Affected Software

Event History

Frequently Asked Questions

Who is exposed to this issue?

What does an attacker need to exploit it?

What is the practical impact of successful exploitation?

Company

Resources

Contact

Frequently Asked Questions

Who is exposed to this issue?

What does an attacker need to exploit it?

What is the practical impact of successful exploitation?