GetPaid WordPress plugin lets low-privilege users bypass invoice permissions

Summary

Three flaws in the GetPaid payment and invoicing plugin for WordPress before 2.8.63 let Editor or Author accounts view others' invoices or mark them paid. Unauthenticated visitors can also bypass payment.

Affected when

• Editor or Author account (first flaw)

What to do

Update GetPaid to 2.8.63 or later.

Products and platforms

• Payment forms, Buy now buttons, and Invoicing System | GetPaid

CVE IDs

• CVE-2026-119747 (opens in a new tab)
• CVE-2026-119748 (opens in a new tab)
• CVE-2026-119749 (opens in a new tab)

Sources

• Advisory: wordpress.org (opens in a new tab)
• Write-up: vulncheck.com (opens in a new tab) · vulncheck.com (opens in a new tab) · vulncheck.com (opens in a new tab)
• CVE record: cve.org (opens in a new tab) · cve.org (opens in a new tab) · cve.org (opens in a new tab)

Times

First published 2026-11-04 16:50 UTC

First seen 2026-11-09 15:20 UTC