WordPress Plugin Vulnerabilities

GetPaid 2.8.63 - 2.8.64 - Unauthenticated Payment Bypass via Fractional Item Quantity

Description

The plugin does not ensure item quantities on its payment forms are whole numbers, allowing unauthenticated users to have an invoice for a priced item marked as paid without being charged.

Proof of Concept

Affects Plugins

Plugin icon
invoicing
Fixed in 2.8.65

References

CVE
CVE-2026-123668

Miscellaneous

Original Researcher
Aabideen Bangash
Submitter
Aabideen Bangash
Submitter website
https://www.linkedin.com/in/aabideen-bangash/
Verified
Yes
WPVDB ID
62c1a6ac-0f9f-4402-b72b-8b10ffe6989c

Timeline

Publicly Published
2026-11-09 (about 2 days ago)
Added
2026-11-09 (about 1 day ago)
Last Updated
2026-11-09 (about 1 day ago)

Other

Published
Title
Published
2014-08-01
Title
WordPress - Plupload Unspecified Cross-Site Scripting (XSS)
Published
2018-11-08
Title
WP GDPR Compliance < 1.4.3 - Unauthenticated Call Any Action or Update Any Option
Published
2022-12-29
Title
Passster < 3.5.5.9 - Protection Bypass & Arbitrary Post Access
Published
2026-08-31
Title
Restrict User Access 2.6 - 2.8 - Unauthenticated Content Protection Bypass via REST API Route Normalization
Published
2022-10-21
Title
Quiz And Survey Master < 7.3.11 - Bypass