CVE-2026-119748

The GetPaid plugin for WordPress (versions before 2.8.63 ) is vulnerable to an authorization bypass due to insufficient checks in the process_invoice() function. Unauthenticated attackers can provide a target invoice ID via the maybe_use_invoice parameter to bypass ownership and key validation pe...