CVE-2026-119749
The GetPaid plugin for WordPress before 2.8.63 contains an improper input validation vulnerability…
- Risk score
- 50/100
- CVSS
- 7.5 v3.1
- Published
- 4 Nov 2026
Open in the live forecast Today's forecast
What to know
- What it is
- The GetPaid plugin for WordPress before 2.8.63 contains an improper input validation vulnerability that allows unauthenticated attackers to bypass payment processing by submitting a negative item quantity on a public payment form. Attackers can exploit the unchecked quantity value in process_item() to produce a negati…
- Affected
- See advisory
- Fix
- Upgrade the product to 2.8.63 or later.
- Exploitation
- No known exploitation
Why it is Yellow
- CVSS 7.5 high
- Remotely exploitable without logging in
References
Original description
The GetPaid plugin for WordPress before 2.8.63 contains an improper input validation vulnerability that allows unauthenticated attackers to bypass payment processing by submitting a negative item quantity on a public payment form. Attackers can exploit the unchecked quantity value in process_item() to produce a negative line subtotal that reduces the invoice total to zero, causing process_free_payment() to mark the invoice as paid without any actual gateway charge.
Last activity 4 Nov 2026. Patch Forecast updates every hour.