CVE-2026-119748 GetPaid WordPress Plugin < 2.8.63 Authorization Bypass via maybe_use_invoice
- Exploited in the wild
- Not known
- Fix
- None listed
What is CVE-2026-119748?
CVE-2026-119748 is a medium-severity vulnerability in AyeCode Ltd Payment forms, Buy now buttons, and Invoicing System | GetPaid, published on 4 Nov 2026.
Official description
The GetPaid plugin for WordPress before 2.8.63 contains an authorization bypass vulnerability that allows unauthenticated attackers to access and manipulate another user's invoice by supplying its ID through the maybe_use_invoice parameter in process_invoice(), bypassing the ownership and key checks performed by is_authorized_to_pay(). Attackers can submit a known pending invoice ID via maybe_use_invoice to read checkout pricing details and initiate a checkout workflow, resulting in an unauthorized state change of the invoice to on-hold.
Weakness: CWE-639
Which versions are affected by CVE-2026-119748?
How do I fix CVE-2026-119748?
No fix has been published for CVE-2026-119748 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-119748 being exploited?
There is no known exploitation of CVE-2026-119748 in the wild and no public exploit code.
Sources
Also known as GHSA-hr58-8ppj-xwvg.