HIGH 8.7 NVD
CVE-2026-119749
The GetPaid plugin for WordPress before 2.8.63 contains an improper input validation vulnerability that allows unauthenticated attackers to bypass payment proce
The GetPaid plugin for WordPress before 2.8.63 contains an improper input validation vulnerability that allows unauthenticated attackers to bypass payment processing by submitting a negative item quantity on a public payment form. Attackers can exploit the unchecked quantity value in process_item() to produce a negative line subtotal that reduces the invoice total to zero, causing process_free_payment() to mark the invoice as paid without any actual gateway charge.
References
- https://wordpress.org/plugins/invoicing/#developers
- https://www.vulncheck.com/advisories/getpaid-wordpress-plugin-negative-quantity-payment-by
This high severity vulnerability with a CVSS score of 8.7 was published on 2026-11-04 via NVD.
vulnfeed aggregates 18258 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.