{"id":"CVE-2026-119748","kind":"vulnerability","aliases":["CVE-2026-119748"],"related":[],"title":"WordPress GetPaid plugin: unauthenticated users can access and change other users' invoices","description":"The GetPaid plugin for WordPress before 2.8.63 contains an authorization bypass vulnerability that allows unauthenticated attackers to access and manipulate another user's invoice by supplying its ID through the maybe_use_invoice parameter in process_invoice(), bypassing the ownership and key checks performed by is_authorized_to_pay(). Attackers can submit a known pending invoice ID via maybe_use_invoice to read checkout pricing details and initiate a checkout workflow, resulting in an unauthorized state change of the invoice to on-hold.","summary":"The GetPaid WordPress plugin before 2.8.63 skips its ownership check on invoices passed through the maybe_use_invoice parameter. An unauthenticated attacker who knows a pending invoice ID can read its checkout pricing and move the invoice to on-hold.","severity":"medium","cvss":6.9,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["ecommerce","getpaid","package","wordpress"],"not_affected_if":["plugin-at-2.8.63-or-later","plugin-not-installed"],"how_to_check":"- Check the installed GetPaid plugin version in the WordPress admin under Plugins; a version below `2.8.63` is exposed.\n- Look for the `maybe_use_invoice` parameter handling in the plugin's `process_invoice()` function if you maintain a fork.","fix":"- GetPaid plugin: move to `2.8.63` or later.","status":"open","published_at":"2026-11-04T17:17:34+00:00","first_seen_at":"2026-11-04T17:28:12+00:00","triaged_at":"2026-11-04T17:28:47+00:00","updated_at":"2026-11-04T17:28:47+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-11-04T17:28:47Z","model":"claude-haiku-5-5","output":{"fix":"- GetPaid plugin: move to `2.8.63` or later.","reach":"internet","title":"WordPress GetPaid plugin: unauthenticated users can access and change other users' invoices","impact":"medium","summary":"The GetPaid WordPress plugin before 2.8.63 skips its ownership check on invoices passed through the maybe_use_invoice parameter. An unauthenticated attacker who knows a pending invoice ID can read its checkout pricing and move the invoice to on-hold.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","getpaid","ecommerce"],"confidence":0.7,"fix_status":"available","needs_auth":"no","worst_case":"Attacker reads invoice pricing and changes invoice status to on-hold","analyst_note":"","how_to_check":"- Check the installed GetPaid plugin version in the WordPress admin under Plugins; a version below `2.8.63` is exposed.\n- Look for the `maybe_use_invoice` parameter handling in the plugin's `process_invoice()` function if you maintain a fork.","plain_action":"","needs_analyst":false,"not_affected_if":["plugin-at-2.8.63-or-later","plugin-not-installed"],"who_is_affected":"Sites running the GetPaid WordPress plugin before 2.8.63 that accept invoices or checkouts. The flaw is reachable without logging in, so any public checkout flow on an affected site is the exposure. Sites without GetPaid, or already on 2.8.63 or later, are not affected.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000713,"input_tokens":4236,"output_tokens":578,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-119748':15A,18A '-2026':14A,17A '2.8.63':28B,70C 'access':7A,81C 'allow':77C 'anoth':84C 'attack':44B,79C,113C 'author':73C,110C 'bypass':74C,101C 'chang':9A,140C 'check':32B,106C 'checkout':54B,127C,133C 'contain':71C 'cve':13A,16A 'detail':129C 'ecommerc':19B 'getpaid':2A,20B,24B,65C 'hold':63B,147C 'id':50B,91C,120C 'initi':131C 'invoic':12A,34B,40B,49B,59B,87C,96C,100C,119C,124C,143C 'key':105C 'know':46B 'known':117C 'manipul':83C 'mayb':38B,94C,122C 'move':57B 'on-hold':61B,145C 'ownership':31B,103C 'packag':21B 'paramet':41B,97C 'pass':35B 'pay':112C 'pend':48B,118C 'perform':107C 'plugin':3A,26B,66C 'price':55B,128C 'process':99C 'read':52B,126C 'result':135C 'skip':29B 'state':139C 'submit':115C 'suppli':89C 'unauthent':4A,43B,78C 'unauthor':138C 'use':39B,95C,123C 'user':5A,11A,85C 'via':121C 'vulner':75C 'wordpress':1A,22B,25B,68C 'workflow':134C","nicknames":[],"mitigations":[],"who_affected":"Sites running the GetPaid WordPress plugin before 2.8.63 that accept invoices or checkouts. The flaw is reachable without logging in, so any public checkout flow on an affected site is the exposure. Sites without GetPaid, or already on 2.8.63 or later, are not affected.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["ecommerce","getpaid","medium","package","wordpress"],"campaign_type":null,"first_public_at":"2026-11-04T17:17:34+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-119748","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-119748","severity":null,"published_at":"2026-11-04T17:17:34+00:00","modified_at":"2026-11-04T17:17:34+00:00","first_seen_at":"2026-11-04T17:28:12+00:00","fetched_at":"2026-11-04T17:28:12+00:00","note":null}],"documents":[{"id":68865,"url":"https://www.vulncheck.com/advisories/getpaid-wordpress-plugin-authorization-bypass-via-maybe-use-invoice","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}