CVE-2026-119748 in GetPaid Plugin
Summary
by MITRE • 11/04/2026
The GetPaid plugin for WordPress before 2.8.63 contains an authorization bypass vulnerability that allows unauthenticated attackers to access and manipulate another user's invoice by supplying its ID through the maybe_use_invoice parameter in process_invoice(), bypassing the ownership and key checks performed by is_authorized_to_pay(). Attackers can submit a known pending invoice ID via maybe_use_invoice to read checkout pricing details and initiate a checkout workflow, resulting in an unauthorized state change of the invoice to on-hold.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 11/04/2026
The GetPaid plugin for WordPress versions prior to 2.8.63 contains a critical authorization bypass vulnerability that undermines the integrity of financial transactions within e-commerce environments utilizing this platform. This flaw specifically affects the process_invoice function, where an attacker can manipulate the invoice state by supplying a specific identifier through the maybe_use_invoice parameter. The core technical failure lies in the plugin's logic flow, which allows unauthenticated users to bypass ownership verification and cryptographic key checks that are normally enforced by the is_authorized_to_pay method. By directly injecting a known pending invoice ID into this parameter, an attacker can trick the system into treating their request as legitimate without possessing the required authentication credentials or valid payment keys associated with the target user account.
From a technical perspective, this vulnerability represents a classic case of insecure direct object reference combined with broken access control. The application fails to validate that the requesting entity has permission to interact with the specified invoice resource before executing state-changing operations. Instead of relying solely on session-based authentication or token validation for sensitive actions like modifying payment statuses, the plugin relies partially on parameter input without sufficient backend verification against user ownership records. This allows an unauthenticated actor to read sensitive checkout pricing details and initiate a checkout workflow that results in an unauthorized state change of the invoice from pending to on-hold. Such manipulation disrupts normal business operations by altering transaction states without actual payment completion, potentially leading to data inconsistency or denial of service for legitimate merchants managing their order queues.
The operational impact of this vulnerability is significant for businesses relying on WordPress and GetPaid for revenue generation. Unauthorized access to invoice details exposes sensitive customer information including pricing structures and potential personal identifiers linked to the checkout process. Furthermore, forcing an invoice into an on-hold state can stall fulfillment processes, create confusion in accounting records, and require manual intervention by administrators to resolve discrepancies. In high-volume environments, this could lead to substantial financial losses due to delayed shipments or incorrect inventory allocation based on false transaction states. The ability to manipulate these states without authentication also opens the door for further exploitation if other parts of the system assume that an invoice in a specific state has undergone proper validation procedures.
This vulnerability aligns with CWE-284, which describes Improper Access Control, as well as CWE-601, URL Redirection to Untrusted Site (Open Redirect) concepts when considering how parameters are handled without strict validation. In the context of the MITRE ATT&CK framework, this behavior corresponds to T1530 Data from Cloud Storage Object or more accurately T1078 Valid Accounts if we consider the bypass as a method to impersonate authorized users through parameter manipulation rather than credential theft. It also reflects aspects of T1496 Remote File Inclusion in terms of exploiting system logic flaws, though primarily it is an access control failure. To mitigate this risk, administrators must immediately upgrade the GetPaid plugin to version 2.8.63 or later where these authorization checks have been hardened. Additionally, implementing strict input validation and ensuring that all state-changing operations require robust server-side authentication verification will prevent similar bypasses in other plugins or custom code. Regular security audits focusing on access control logic are recommended to identify and remediate such flaws before they can be exploited by malicious actors targeting WordPress-based e-commerce sites.