Improper Input Validation in GetPaid Plugin for WordPress
CVE-2026-119749

8.7HIGH

Key Information:

Vendor

WordPress
Status
Payment Forms, Buy Now Buttons, And Invoicing System | Getpaid
Vendor
CVE Published:
4 November 2026

What is CVE-2026-119749?

The GetPaid plugin for WordPress prior to version 2.8.63 is susceptible to an improper input validation flaw. This vulnerability permits unauthenticated attackers to manipulate payment processes. By submitting a negative item quantity on a public payment form, an attacker can exploit the unchecked quantity value in the process_item() function. This manipulation leads to the generation of a negative line subtotal, effectively reducing the invoice total to zero. Consequently, the process_free_payment() function incorrectly marks the invoice as paid with no actual transaction occurring. This issue underscores the importance of rigorous input validation in payment processing functionalities.

Affected Version(s)

Payment forms, Buy now buttons, and Invoicing System | GetPaid 0 < 2.8.63

References

https://wordpress.org/plugins/invoicing/#developers
release-notespatch
https://www.vulncheck.com/advisories/getpaid-wordpress-pl...
third-party-advisory

CVSS V4

Score:
8.7
Severity:
HIGH
Confidentiality:
None
Integrity:
High
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Idan Malihi
.