CVE-2026-119747 in GetPaid Plugin
Summary
by MITRE • 11/04/2026
The GetPaid plugin for WordPress before 2.8.63 contains an incorrect authorization vulnerability where the check_post_permissions() method in includes/api/class-getpaid-rest-posts-controller.php maps REST operations to generic WordPress post capabilities instead of enforcing the plugin's manage_invoicing permission. Authenticated users with lower-privileged roles such as Editor or Author can exploit this flaw to list other users' invoices, mark pending invoices as paid without recording payment transactions, or create published items and new invoices through the REST API.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 11/04/2026
The vulnerability identified in GetPaid for WordPress versions prior to 2.8.63 represents a critical failure in access control logic within the plugin's REST API implementation. This flaw is classified under CWE-285, which describes Improper Authorization, and aligns with MITRE ATT&CK technique T1078, specifically relating to Valid Accounts and Default Accounts where an attacker leverages legitimate credentials but exploits insufficient privilege checks. The core of the issue resides in the getpaid_rest_posts_controller.php file, particularly within the check_post_permissions method. This function is responsible for validating whether a user has the necessary rights to perform specific actions on invoice posts via the REST API. Instead of verifying that the authenticated user possesses the specific manage_invoicing capability defined by the GetPaid plugin itself, the code erroneously delegates this check to generic WordPress post capabilities such as edit_posts or publish_posts. This architectural oversight creates a significant security gap because it allows users with standard content-creation roles to bypass intended restrictions on sensitive financial data and operations.
Authenticated attackers possessing lower-level privileges, such as Editor or Author roles in a typical WordPress installation, can exploit this misconfiguration to perform actions that should be restricted to administrators or specialized billing managers. By leveraging the REST API endpoints associated with invoice posts, these users can enumerate other users' invoices without authorization. This capability leads directly to CWE-200, an Information Exposure vulnerability, as sensitive financial details including customer information, payment statuses, and transaction amounts become accessible to unauthorized parties. Furthermore, the flaw permits attackers to manipulate the state of transactions by marking pending invoices as paid. Crucially, this action does not trigger the necessary backend logic to record actual payment transactions or update inventory levels accordingly. This discrepancy between the UI/API state change and the underlying database integrity constitutes a form of CWE-840, Incorrect Permission Assignment for Critical Resource, which can lead to severe financial discrepancies and audit trail corruption within the e-commerce environment.
The operational impact of this vulnerability extends beyond mere data leakage into potential business logic abuse and fraud. An attacker could create new invoices or published items through the REST API without proper oversight, potentially manipulating sales records or generating fraudulent transactions that appear legitimate due to their origin from a valid user account. This undermines the integrity of financial reporting systems integrated with WordPress and can result in significant revenue loss if left unaddressed. The ability to mark invoices as paid without recording payments effectively allows for the concealment of unpaid debts, complicating accounting processes and potentially violating compliance standards related to financial record-keeping such as PCI DSS requirements for maintaining accurate transaction logs.
Mitigation strategies must prioritize immediate remediation through software updates. Administrators running GetPaid should upgrade to version 2.8.63 or later, where the check_post_permissions method has been corrected to enforce the specific manage_invoicing capability rather than relying on generic post permissions. In environments where patching is not immediately feasible, temporary mitigations include restricting access to the WordPress REST API endpoints for non-administrative users via server-level firewall rules or plugin-based restrictions that limit exposure of invoice-related routes. Additionally, implementing strict logging and monitoring for changes in invoice status can help detect unauthorized modifications promptly. Regular security audits focusing on custom plugins' adherence to standard authorization patterns are essential to prevent similar misconfigurations where business-specific permissions are overridden by generic system capabilities.