---
id: "CVE-2026-119747"
kind: "vulnerability"
aliases: ["CVE-2026-119747"]
title: "WordPress GetPaid plugin: low-privilege users can read and alter invoices"
severity: "high"
cvss: 7.1
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["ecommerce", "getpaid", "invoicing", "package", "wordpress"]
not_affected_if: ["no-editor-or-author-accounts", "plugin-version-2.8.63-or-later"]
published_at: "2026-11-04T17:17:34+00:00"
first_seen_at: "2026-11-04T17:28:12+00:00"
updated_at: "2026-11-04T17:28:43+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-119747", "first_seen_at": "2026-11-04T17:28:12+00:00"}]
---

# WordPress GetPaid plugin: low-privilege users can read and alter invoices

The GetPaid WordPress plugin before 2.8.63 checks generic WordPress post permissions instead of its own invoicing permission on its REST API. An authenticated Editor or Author can list other users' invoices, mark pending invoices as paid without a payment record, and create published items and invoices.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed GetPaid plugin version in the WordPress admin Plugins screen; versions below `2.8.63` are affected.
- Review which accounts hold Editor or Author roles on the site.

## Fix

- GetPaid plugin: move to `2.8.63` or later.

## Timeline

- 2026-11-04T17:28:12+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-119747

## Documents

- [advisory] Third-party advisory: www.vulncheck.com https://www.vulncheck.com/advisories/getpaid-wordpress-plugin-incorrect-authorization-via-rest-api

## From the sources

The GetPaid plugin for WordPress before 2.8.63 contains an incorrect authorization vulnerability where the check_post_permissions() method in includes/api/class-getpaid-rest-posts-controller.php maps REST operations to generic WordPress post capabilities instead of enforcing the plugin's manage_invoicing permission. Authenticated users with lower-privileged roles such as Editor or Author can exploit this flaw to list other users' invoices, mark pending invoices as paid without recording payment transactions, or create published items and new invoices through the REST API.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_