---
id: "CVE-2026-119748"
kind: "vulnerability"
aliases: ["CVE-2026-119748"]
title: "WordPress GetPaid plugin: unauthenticated users can access and change other users' invoices"
severity: "medium"
cvss: 6.9
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["ecommerce", "getpaid", "package", "wordpress"]
not_affected_if: ["plugin-at-2.8.63-or-later", "plugin-not-installed"]
published_at: "2026-11-04T17:17:34+00:00"
first_seen_at: "2026-11-04T17:28:12+00:00"
updated_at: "2026-11-04T17:28:47+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-119748", "first_seen_at": "2026-11-04T17:28:12+00:00"}]
---

# WordPress GetPaid plugin: unauthenticated users can access and change other users' invoices

The GetPaid WordPress plugin before 2.8.63 skips its ownership check on invoices passed through the maybe_use_invoice parameter. An unauthenticated attacker who knows a pending invoice ID can read its checkout pricing and move the invoice to on-hold.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed GetPaid plugin version in the WordPress admin under Plugins; a version below `2.8.63` is exposed.
- Look for the `maybe_use_invoice` parameter handling in the plugin's `process_invoice()` function if you maintain a fork.

## Fix

- GetPaid plugin: move to `2.8.63` or later.

## Timeline

- 2026-11-04T17:28:12+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-119748

## Documents

- [advisory] Third-party advisory: www.vulncheck.com https://www.vulncheck.com/advisories/getpaid-wordpress-plugin-authorization-bypass-via-maybe-use-invoice

## From the sources

The GetPaid plugin for WordPress before 2.8.63 contains an authorization bypass vulnerability that allows unauthenticated attackers to access and manipulate another user's invoice by supplying its ID through the maybe_use_invoice parameter in process_invoice(), bypassing the ownership and key checks performed by is_authorized_to_pay(). Attackers can submit a known pending invoice ID via maybe_use_invoice to read checkout pricing details and initiate a checkout workflow, resulting in an unauthorized state change of the invoice to on-hold.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_