Live Vulnerability Intelligence
Threat Database
Search CVEs, inspect descriptions, and open detail pages with AI-assisted technical context.
Threat Entry
Updated 2026-11-04
GetPaid - Security Vulnerability (CVE-2026-119749)
The GetPaid plugin for WordPress before 2.8.63 contains an improper input validation vulnerability that allows unauthenticated attackers to bypass payment processing by submitting a negative item quantity on a public payment form. Attackers can exploit the unchecked quantity value in process_item() to produce a negative line subtotal that reduces the invoice total to zero, causing process_free_payment() to mark the invoice as paid without any actual gateway charge.
PLUGIN
GetPaid
CVE-2026-119749
Risk Score
Threat Entry
Updated 2026-11-04
GetPaid - Security Vulnerability (CVE-2026-119747)
The GetPaid plugin for WordPress before 2.8.63 contains an incorrect authorization vulnerability where the check_post_permissions() method in includes/api/class-getpaid-rest-posts-controller.php maps REST operations to generic WordPress post capabilities instead of enforcing the plugin's manage_invoicing permission. Authenticated users with lower-privileged roles such as Editor or Author can exploit this flaw to list other users' invoices, mark pending invoices as paid without recording payment transactions, or create published items and new invoices through the REST API.
PLUGIN
GetPaid
CVE-2026-119747
Risk Score
Threat Entry
Updated 2026-11-04
GetPaid - Security Vulnerability (CVE-2026-119748)
The GetPaid plugin for WordPress before 2.8.63 contains an authorization bypass vulnerability that allows unauthenticated attackers to access and manipulate another user's invoice by supplying its ID through the maybe_use_invoice parameter in process_invoice(), bypassing the ownership and key checks performed by is_authorized_to_pay(). Attackers can submit a known pending invoice ID via maybe_use_invoice to read checkout pricing details and initiate a checkout workflow, resulting in an unauthorized state change of the invoice to on-hold.
PLUGIN
GetPaid
CVE-2026-119748
Risk Score
Threat Entry
Updated 2026-08-26
GetPaid - Security Vulnerability (CVE-2026-12901)
The GetPaid WordPress plugin before 2.8.55 does not verify the authenticity of incoming Worldpay payment notifications, allowing unauthenticated attackers to forge a notification that marks a pending invoice as paid without any payment being made.
PLUGIN
GetPaid
CVE-2026-12901
Risk Score
Threat Entry
Updated 2026-06-17
Getpaid - Broken Access Control (CVE-2024-43973)
Missing Authorization vulnerability in Stiofan GetPaid invoicing allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects GetPaid: from n/a through
PLUGIN
Getpaid
CVE-2024-43973
Risk Score
Threat Entry
Updated 2026-06-17
Getpaid - Privilege Escalation (CVE-2021-24369)
In the GetPaid WordPress plugin before 2.3.4, users with the contributor role and above can create a new Payment Form, however the Label and Help Text input fields were not getting sanitized properly. So it was possible to inject malicious content such as img tags, leading to a Stored Cross-Site Scripting issue which is triggered when the form will be edited, for example when an admin reviews it and could lead to privilege escalation.
PLUGIN
Getpaid
CVE-2021-24369
Risk Score