{"id":"CVE-2026-119747","kind":"vulnerability","aliases":["CVE-2026-119747"],"related":[],"title":"WordPress GetPaid plugin: low-privilege users can read and alter invoices","description":"The GetPaid plugin for WordPress before 2.8.63 contains an incorrect authorization vulnerability where the check_post_permissions() method in includes/api/class-getpaid-rest-posts-controller.php maps REST operations to generic WordPress post capabilities instead of enforcing the plugin's manage_invoicing permission. Authenticated users with lower-privileged roles such as Editor or Author can exploit this flaw to list other users' invoices, mark pending invoices as paid without recording payment transactions, or create published items and new invoices through the REST API.","summary":"The GetPaid WordPress plugin before 2.8.63 checks generic WordPress post permissions instead of its own invoicing permission on its REST API. An authenticated Editor or Author can list other users' invoices, mark pending invoices as paid without a payment record, and create published items and invoices.","severity":"high","cvss":7.1,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["ecommerce","getpaid","invoicing","package","wordpress"],"not_affected_if":["no-editor-or-author-accounts","plugin-version-2.8.63-or-later"],"how_to_check":"- Check the installed GetPaid plugin version in the WordPress admin Plugins screen; versions below `2.8.63` are affected.\n- Review which accounts hold Editor or Author roles on the site.","fix":"- GetPaid plugin: move to `2.8.63` or later.","status":"open","published_at":"2026-11-04T17:17:34+00:00","first_seen_at":"2026-11-04T17:28:12+00:00","triaged_at":"2026-11-04T17:28:43+00:00","updated_at":"2026-11-04T17:28:43+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-11-04T17:28:43Z","model":"claude-haiku-5-5","output":{"fix":"- GetPaid plugin: move to `2.8.63` or later.","reach":"internet","title":"WordPress GetPaid plugin: low-privilege users can read and alter invoices","impact":"medium","summary":"The GetPaid WordPress plugin before 2.8.63 checks generic WordPress post permissions instead of its own invoicing permission on its REST API. An authenticated Editor or Author can list other users' invoices, mark pending invoices as paid without a payment record, and create published items and invoices.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","getpaid","ecommerce","invoicing"],"confidence":0.8,"fix_status":"available","needs_auth":"yes","worst_case":"invoice data read and payments falsely marked as paid","analyst_note":"","how_to_check":"- Check the installed GetPaid plugin version in the WordPress admin Plugins screen; versions below `2.8.63` are affected.\n- Review which accounts hold Editor or Author roles on the site.","plain_action":"","needs_analyst":false,"not_affected_if":["plugin-version-2.8.63-or-later","no-editor-or-author-accounts"],"who_is_affected":"Sites running the GetPaid plugin before 2.8.63 where users with Editor or Author roles exist. The flaw requires a logged-in account, so sites with only administrators or no multi-user accounts face less exposure. unknown whether other configurations change exposure.","user_interaction":"no","needs_special_setup":"no","severity_if_unknown":"high"},"cost_usd":0.000694,"input_tokens":4233,"output_tokens":541,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-119747':15A,18A '-2026':14A,17A '2.8.63':29B,76C 'alter':11A 'api':44B,147C 'authent':46B,107C 'author':49B,80C,118C 'capabl':97C 'check':30B,84C 'contain':77C 'creat':65B,138C 'cve':13A,16A 'ecommerc':19B 'editor':47B,116C 'enforc':100C 'exploit':120C 'flaw':122C 'generic':31B,94C 'getpaid':2A,20B,25B,71C 'includes/api/class-getpaid-rest-posts-controller.php':89C 'incorrect':79C 'instead':35B,98C 'invoic':12A,21B,39B,54B,57B,69B,105C,127C,130C,143C 'item':67B,140C 'list':51B,124C 'low':5A 'low-privileg':4A 'lower':111C 'lower-privileg':110C 'manag':104C 'map':90C 'mark':55B,128C 'method':87C 'new':142C 'oper':92C 'packag':22B 'paid':59B,132C 'payment':62B,135C 'pend':56B,129C 'permiss':34B,40B,86C,106C 'plugin':3A,27B,72C,102C 'post':33B,85C,96C 'privileg':6A,112C 'publish':66B,139C 'read':9A 'record':63B,134C 'rest':43B,91C,146C 'role':113C 'transact':136C 'user':7A,53B,108C,126C 'vulner':81C 'without':60B,133C 'wordpress':1A,23B,26B,32B,74C,95C","nicknames":[],"mitigations":[],"who_affected":"Sites running the GetPaid plugin before 2.8.63 where users with Editor or Author roles exist. The flaw requires a logged-in account, so sites with only administrators or no multi-user accounts face less exposure. unknown whether other configurations change exposure.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["ecommerce","getpaid","high","invoicing","package","wordpress"],"campaign_type":null,"first_public_at":"2026-11-04T17:17:34+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-119747","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-119747","severity":null,"published_at":"2026-11-04T17:17:34+00:00","modified_at":"2026-11-04T17:17:34+00:00","first_seen_at":"2026-11-04T17:28:12+00:00","fetched_at":"2026-11-04T17:28:12+00:00","note":null}],"documents":[{"id":68864,"url":"https://www.vulncheck.com/advisories/getpaid-wordpress-plugin-incorrect-authorization-via-rest-api","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}