Authorization Bypass in GetPaid WordPress Plugin by Simply Submitting Invoice ID

CVE-2026-119748

What is CVE-2026-119748?

The GetPaid plugin for WordPress prior to version 2.8.63 is susceptible to an authorization bypass vulnerability. This flaw enables unauthenticated attackers to access and manipulate invoices by providing the invoice ID through the maybe_use_invoice parameter in the process_invoice() function. By circumventing the key checks implemented by is_authorized_to_pay(), attackers can exploit this vulnerability to read sensitive checkout pricing details and even alter the status of the invoice, potentially changing it to on-hold. This puts sensitive financial data at risk, emphasizing the critical need for users to update their plugins to the latest version to mitigate this risk.

References