{"id":"CVE-2026-119749","kind":"vulnerability","aliases":["CVE-2026-119749"],"related":[],"title":"GetPaid WordPress plugin: negative quantity lets unpaid invoices be marked paid","description":"The GetPaid plugin for WordPress before 2.8.63 contains an improper input validation vulnerability that allows unauthenticated attackers to bypass payment processing by submitting a negative item quantity on a public payment form. Attackers can exploit the unchecked quantity value in process_item() to produce a negative line subtotal that reduces the invoice total to zero, causing process_free_payment() to mark the invoice as paid without any actual gateway charge.","summary":"The GetPaid plugin for WordPress before 2.8.63 does not validate item quantities on its public payment form. An unauthenticated visitor can submit a negative quantity so the invoice total drops to zero and the invoice is marked paid without any gateway charge.","severity":"high","cvss":8.7,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["ecommerce","getpaid","package","payments","wordpress"],"not_affected_if":["no-public-payment-form","plugin-not-installed","version-2.8.63-or-later"],"how_to_check":"- Check the installed GetPaid version in the WordPress admin plugin list or in the plugin's main file header, and compare it with `2.8.63`.\n- Look for recent invoices marked paid with a zero or no gateway transaction.","fix":"- GetPaid (WordPress plugin): upgrade to `2.8.63` or later.","status":"open","published_at":"2026-11-04T17:17:34+00:00","first_seen_at":"2026-11-04T17:28:12+00:00","triaged_at":"2026-11-04T17:28:43+00:00","updated_at":"2026-11-04T17:28:43+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-11-04T17:28:43Z","model":"claude-haiku-5-5","output":{"fix":"- GetPaid (WordPress plugin): upgrade to `2.8.63` or later.","reach":"internet","title":"GetPaid WordPress plugin: negative quantity lets unpaid invoices be marked paid","impact":"medium","summary":"The GetPaid plugin for WordPress before 2.8.63 does not validate item quantities on its public payment form. An unauthenticated visitor can submit a negative quantity so the invoice total drops to zero and the invoice is marked paid without any gateway charge.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","getpaid","ecommerce","payments"],"confidence":0.7,"fix_status":"available","needs_auth":"no","worst_case":"Invoices marked paid without payment, causing revenue loss","analyst_note":"","how_to_check":"- Check the installed GetPaid version in the WordPress admin plugin list or in the plugin's main file header, and compare it with `2.8.63`.\n- Look for recent invoices marked paid with a zero or no gateway transaction.","plain_action":"","needs_analyst":false,"not_affected_if":["plugin-not-installed","version-2.8.63-or-later","no-public-payment-form"],"who_is_affected":"Sites running the GetPaid plugin below 2.8.63 with its public payment form enabled are exposed, since the flaw needs no login. Sites without GetPaid, or already on 2.8.63 or later, can skip it. Sites that only use GetPaid for admin-created invoices are less exposed but should still update.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000706,"input_tokens":4195,"output_tokens":573,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-119749':14A,17A '-2026':13A,16A '2.8.63':29B,71C 'actual':132C 'allow':79C 'attack':81C,97C 'bypass':83C 'caus':120C 'charg':64B,134C 'contain':72C 'cve':12A,15A 'drop':52B 'ecommerc':18B 'exploit':99C 'form':39B,96C 'free':122C 'gateway':63B,133C 'getpaid':1A,19B,24B,66C 'improp':74C 'input':75C 'invoic':8A,50B,57B,116C,127C 'item':33B,90C,106C 'let':6A 'line':111C 'mark':10A,59B,125C 'negat':4A,46B,89C,110C 'packag':20B 'paid':11A,60B,129C 'payment':21B,38B,84C,95C,123C 'plugin':3A,25B,67C 'process':85C,105C,121C 'produc':108C 'public':37B,94C 'quantiti':5A,34B,47B,91C,102C 'reduc':114C 'submit':44B,87C 'subtot':112C 'total':51B,117C 'unauthent':41B,80C 'uncheck':101C 'unpaid':7A 'valid':32B,76C 'valu':103C 'visitor':42B 'vulner':77C 'without':61B,130C 'wordpress':2A,22B,27B,69C 'zero':54B,119C","nicknames":[],"mitigations":[],"who_affected":"Sites running the GetPaid plugin below 2.8.63 with its public payment form enabled are exposed, since the flaw needs no login. Sites without GetPaid, or already on 2.8.63 or later, can skip it. Sites that only use GetPaid for admin-created invoices are less exposed but should still update.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["ecommerce","getpaid","high","package","payments","wordpress"],"campaign_type":null,"first_public_at":"2026-11-04T17:17:34+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-119749","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-119749","severity":null,"published_at":"2026-11-04T17:17:34+00:00","modified_at":"2026-11-04T17:17:34+00:00","first_seen_at":"2026-11-04T17:28:12+00:00","fetched_at":"2026-11-04T17:28:12+00:00","note":null}],"documents":[{"id":68866,"url":"https://www.vulncheck.com/advisories/getpaid-wordpress-plugin-negative-quantity-payment-bypass","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}