GetPaid < 2.8.55 – Unauthenticated Worldpay Payment Bypass via Insufficient IPN Verification | CVE 2026-12901

Description

The plugin does not verify the authenticity of incoming Worldpay payment notifications, allowing unauthenticated attackers to forge a notification that marks a pending invoice as paid without any payment being made.

Proof of Concept

Prerequisites:
- GetPaid (invoicing) <= 2.8.52 active.
- An administrator has enabled the Worldpay gateway (GetPaid > Settings > Payment Gateways > Worldpay) and set the Installation ID. The "Payment Response password" may be set; it is not enforced.
- A target invoice exists in pending status bound to the Worldpay gateway (a buyer reached the Worldpay checkout step). The public Installation ID is readable from the buyer's auto-submitted checkout form.

Steps (all unauthenticated):
1. Read the store's public Worldpay Installation ID from a Worldpay checkout form.
2. Identify a pending Worldpay invoice (the id is a sequential WordPress post ID; the invoice number is enumerable).
3. POST a forged Worldpay payment notification:

   curl -sk -X POST "https://TARGET/?wpi-listener=IPN&wpi-gateway=worldpay" \
     --data-urlencode "instId=<PUBLIC_INSTALLATION_ID>" \
     --data-urlencode "cartId=<INVOICE_NUMBER>" \
     --data-urlencode "MC_invoice_id=<INVOICE_ID>" \
     --data-urlencode "transStatus=Y" \
     --data-urlencode "transId=FORGED-TXN-0001" \
     --data-urlencode "transTime=1718000000"

Result: the targeted invoice transitions to paid (status publish, is_paid=true) with the attacker-supplied transaction id, with no payment made, no authentication, no nonce, and no knowledge of any secret. A forged notification carrying a wrong Installation ID is rejected, confirming the public Installation ID is the only gate.