CVE-2026-123668 · Package
NO FIX YET · SEE WHAT TO DO
The GetPaid WordPress plugin versions 2.8.63 to 2.8.64 do not require item quantities on payment forms to be whole numbers. An unauthenticated visitor can submit a fractional quantity so an invoice for a priced item is marked as paid without being charged.
first public Nov 11, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Sites running the GetPaid WordPress plugin between 2.8.63 and 2.8.64 that accept payments through its forms. Sites on other versions or without GetPaid payment forms are not indicated as affected.
Not affected if no-payment-forms, other-plugin-versions
Who cares getpaid, payments, wordpress
wp-content/plugins/getpaid/2.8.64The GetPaid WordPress plugin from 2.8.63 to 2.8.64 does not ensure item quantities on its payment forms are whole numbers, allowing unauthenticated users to have an invoice for a priced item marked as paid without being charged.
This page as .md · .json · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.