---
id: "CVE-2026-119749"
kind: "vulnerability"
aliases: ["CVE-2026-119749"]
title: "GetPaid WordPress plugin: negative quantity lets unpaid invoices be marked paid"
severity: "high"
cvss: 8.7
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["ecommerce", "getpaid", "package", "payments", "wordpress"]
not_affected_if: ["no-public-payment-form", "plugin-not-installed", "version-2.8.63-or-later"]
published_at: "2026-11-04T17:17:34+00:00"
first_seen_at: "2026-11-04T17:28:12+00:00"
updated_at: "2026-11-04T17:28:43+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-119749", "first_seen_at": "2026-11-04T17:28:12+00:00"}]
---

# GetPaid WordPress plugin: negative quantity lets unpaid invoices be marked paid

The GetPaid plugin for WordPress before 2.8.63 does not validate item quantities on its public payment form. An unauthenticated visitor can submit a negative quantity so the invoice total drops to zero and the invoice is marked paid without any gateway charge.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed GetPaid version in the WordPress admin plugin list or in the plugin's main file header, and compare it with `2.8.63`.
- Look for recent invoices marked paid with a zero or no gateway transaction.

## Fix

- GetPaid (WordPress plugin): upgrade to `2.8.63` or later.

## Timeline

- 2026-11-04T17:28:12+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-119749

## Documents

- [advisory] Third-party advisory: www.vulncheck.com https://www.vulncheck.com/advisories/getpaid-wordpress-plugin-negative-quantity-payment-bypass

## From the sources

The GetPaid plugin for WordPress before 2.8.63 contains an improper input validation vulnerability that allows unauthenticated attackers to bypass payment processing by submitting a negative item quantity on a public payment form. Attackers can exploit the unchecked quantity value in process_item() to produce a negative line subtotal that reduces the invoice total to zero, causing process_free_payment() to mark the invoice as paid without any actual gateway charge.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_