CVE-2026-119749 | BDVDB-2026-400306 Detail

Description#

The GetPaid plugin for WordPress before 2.8.63 contains an improper input validation vulnerability that allows unauthenticated attackers to bypass payment processing by submitting a negative item quantity on a public payment form. Attackers can exploit the unchecked quantity value in process_item() to produce a negative line subtotal that reduces the invoice total to zero, causing process_free_payment() to mark the invoice as paid without any actual gateway charge.

Impact#

Weaknesses#

References#

Exploit#

History#

1. Version 12026-11-04Record published in the CVE List.