CVE-2026-119749 · Package
NO FIX YET · SEE WHAT TO DO
The GetPaid plugin for WordPress before 2.8.63 does not validate item quantities on its public payment form. An unauthenticated visitor can submit a negative quantity so the invoice total drops to zero and the invoice is marked paid without any gateway charge.
first public Nov 4, 2026 · 1 source
Is this in your stack? Find out in 2 minutes.
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
Sites running the GetPaid plugin below 2.8.63 with its public payment form enabled are exposed, since the flaw needs no login. Sites without GetPaid, or already on 2.8.63 or later, can skip it. Sites that only use GetPaid for admin-created invoices are less exposed but should still update.
Not affected if no-public-payment-form, plugin-not-installed, version-2.8.63-or-later
Who cares ecommerce, getpaid, payments, wordpress
2.8.63.2.8.63 or later.The GetPaid plugin for WordPress before 2.8.63 contains an improper input validation vulnerability that allows unauthenticated attackers to bypass payment processing by submitting a negative item quantity on a public payment form. Attackers can exploit the unchecked quantity value in process_item() to produce a negative line subtotal that reduces the invoice total to zero, causing process_free_payment() to mark the invoice as paid without any actual gateway charge.
This page as .md · .json · in your agent: get_signal("CVE-2026-119749") · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.