CVE-2026-119748
Received Received - Intake

Authorization Bypass in GetPaid WordPress Plugin

Publication date: 2026-11-04

Last updated on: 2026-11-04

Assigner: VulnCheck

Description
The GetPaid plugin for WordPress before 2.8.63 contains an authorization bypass vulnerability that allows unauthenticated attackers to access and manipulate another user's invoice by supplying its ID through the maybe_use_invoice parameter in process_invoice(), bypassing the ownership and key checks performed by is_authorized_to_pay(). Attackers can submit a known pending invoice ID via maybe_use_invoice to read checkout pricing details and initiate a checkout workflow, resulting in an unauthorized state change of the invoice to on-hold.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-04
Last Modified
2026-11-04
Generated
2026-11-04
AI Q&A
2026-11-04
EPSS Evaluated
N/A
NVD
CVE-2026-119748
EUVD
EUVD-2026-116999

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
AyeCode Ltd Payment forms, Buy now buttons, and Invoicing System | GetPaid 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-639 The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is an authorization bypass in the GetPaid WordPress plugin before version 2.8.63. It allows unauthenticated attackers to access and manipulate another user's invoice by supplying its ID through the maybe_use_invoice parameter in the process_invoice() function. This bypasses ownership and key checks, enabling attackers to read pricing details and change the invoice status to on-hold without authorization.

Detection Guidance

Check WordPress sites using GetPaid plugin versions before 2.8.63. Inspect server logs for requests containing the maybe_use_invoice parameter in process_invoice() calls. Look for unauthorized invoice status changes to on-hold.

Impact Analysis

If you use the GetPaid plugin before version 2.8.63, attackers could access your invoices, view sensitive pricing details, and change invoice statuses without permission. This could lead to unauthorized transactions, financial loss, or exposure of confidential payment information. The vulnerability affects any website using the vulnerable plugin version.

Compliance Impact

This vulnerability could violate GDPR by exposing personal and payment data in invoices without proper authorization. For HIPAA, if invoices contain protected health information, unauthorized access would breach compliance. The plugin's default public invoice access exacerbates these risks, as sensitive data could be exposed without user consent.

Mitigation Strategies

Update GetPaid plugin to version 2.8.63 or later immediately. Enable the Require Login To Checkout setting in plugin settings to restrict invoice access. Review server logs for signs of exploitation and audit invoice status changes.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-119748. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...