CVE-2026-119748

The GetPaid plugin for WordPress before 2.8.63 contains an authorization bypass vulnerability that allows unauthenticated attackers to access and manipulate another user's invoice by supplying its ID through the maybeuseinvoice parameter in processinvoice, bypassing the ownership and key checks...

CVE-2026-119748

The GetPaid plugin for WordPress (versions before 2.8.63 ) is vulnerable to an authorization bypass due to insufficient checks in the process_invoice() function. Unauthenticated attackers can provide a target invoice ID via the maybe_use_invoice parameter to bypass ownership and key validation pe...

CVE-2026-119748 GetPaid WordPress Plugin < 2.8.63 Authorization Bypass via maybe_use_invoice

The GetPaid plugin for WordPress before 2.8.63 contains an authorization bypass vulnerability that allows unauthenticated attackers to access and manipulate another user's invoice by supplying its ID through the maybeuseinvoice parameter in processinvoice, bypassing the ownership and key checks...

EUVD-2026-116999

The GetPaid plugin for WordPress before 2.8.63 contains an authorization bypass vulnerability that allows unauthenticated attackers to access and manipulate another user's invoice by supplying its ID through the maybeuseinvoice parameter in processinvoice, bypassing the ownership and key checks...