CVE-2026-119749

CVSS 8.7 (high) · published 2026-11-04

The GetPaid plugin for WordPress before 2.8.63 contains an improper input validation vulnerability that allows unauthenticated attackers to bypass payment processing by submitting a negative item quantity on a public payment form. Attackers can exploit the unchecked quantity value in process_item() to produce a negative line subtotal that reduces the invoice total to zero, causing process_free_payment() to mark the invoice as paid without any actual gateway charge.

Weakness: CWE-1284

Source: NVD CVE-2026-119749

References

• https://wordpress.org/plugins/invoicing/#developers
• https://www.vulncheck.com/advisories/getpaid-wordpress-plugin-negative-quantity-payment-bypass

Check your software

Connect an AI agent to the FixLane MCP server or ask the Telegram bot to check what you have installed against incidents with a verified fixed version.