Incorrect Authorization Vulnerability in GetPaid Plugin for WordPress

CVE-2026-119747

What is CVE-2026-119747?

The GetPaid plugin for WordPress, prior to version 2.8.63, has a security vulnerability stemming from improper authorization checks in its REST API. Specifically, the check_post_permissions() method erroneously aligns REST operations with general WordPress post capabilities rather than enforcing the specific manage_invoicing permission required by the plugin. This oversight allows authenticated users with lower-privileged roles, such as Editor or Author, to exploit the vulnerability. They can gain unauthorized access to sensitive actions, including listing other users' invoices, marking pending invoices as paid without documenting transactions, and creating published items along with new invoices through the REST API.

References