---
id: "CVE-2026-123668"
page: "https://infrastack.ai/live/CVE-2026-123668"
kind: "vulnerability"
aliases: ["CVE-2026-123668"]
title: "GetPaid WordPress plugin: fractional quantities let unpaid invoices show as paid"
severity: "medium"
cvss: 5.3
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["getpaid", "package", "payments", "wordpress"]
not_affected_if: ["no-payment-forms", "other-plugin-versions"]
published_at: "2026-11-11T08:17:17+00:00"
first_seen_at: "2026-11-11T08:26:05+00:00"
updated_at: "2026-11-11T08:27:59+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-123668", "first_seen_at": "2026-11-11T08:26:05+00:00"}]
exploit_sources: []
---

# GetPaid WordPress plugin: fractional quantities let unpaid invoices show as paid

Link for people: https://infrastack.ai/live/CVE-2026-123668 (this .md is for agents)

The GetPaid WordPress plugin versions 2.8.63 to 2.8.64 do not require item quantities on payment forms to be whole numbers. An unauthenticated visitor can submit a fractional quantity so an invoice for a priced item is marked as paid without being charged.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed GetPaid plugin version in the WordPress admin plugins list or in `wp-content/plugins/getpaid/`
- Review recent paid invoices for quantities that are not whole numbers

## Fix

- GetPaid plugin: unknown fixed version in the sources; move to a release later than `2.8.64`

## Timeline

- 2026-11-11T08:26:05+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-123668

## From the sources

The GetPaid WordPress plugin from 2.8.63 to 2.8.64 does not ensure item quantities on its payment forms are whole numbers, allowing unauthenticated users to have an invoice for a priced item marked as paid without being charged.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_