CVE-2026-12901: GetPaid < 2.8.55 - Unauthenticated Worldpay Payment Bypass via Insufficient IPN Verification
Published Aug 6, 2026
·Updated
The GetPaid WordPress plugin before 2.8.55 does not verify the authenticity of incoming Worldpay payment notifications, allowing unauthenticated attackers to forge a notification that marks a pending invoice as paid without any payment being made.
Affected Software
1 affected component
WordPress plugin GetPaid<2.8.55
Event History
Aug 6, 2026
CVE Published
via MITRE·05:00 PM
Data Sourced
via MITRE·05:00 PM
DescriptionSeverityWeakness
Data Sourced
via NVD·10:16 PM
DescriptionSeverity
Frequently Asked Questions
1
What is the severity of CVE-2026-12901?
CVE-2026-12901 has a medium severity score of 5.9.
2
How do I fix CVE-2026-12901?
To resolve CVE-2026-12901, update the GetPaid WordPress plugin to version 2.8.55 or later.
3
What does CVE-2026-12901 allow attackers to do?
CVE-2026-12901 allows unauthenticated attackers to bypass payment verification, marking invoices as paid without actual payment.
4
Which WordPress plugin is affected by CVE-2026-12901?
CVE-2026-12901 affects the GetPaid WordPress plugin versions prior to 2.8.55.
5
When was CVE-2026-12901 published?
CVE-2026-12901 was published on August 6, 2026.