GetPaid: Improper input validation leading to payment bypass (CVE-2026-119749)

The GetPaid plugin for WordPress contains an improper input validation vulnerability (CVE-2026-119749) that allows unauthenticated attackers to manipulate payment processing. By supplying a negative quantity value via a public payment form, an attacker can influence the process_item() function to generate a negative line subtotal. This result reduces the overall invoice total to zero, which subsequently triggers the process_free_payment() function to mark the invoice as paid without requiring a successful payment gateway transaction.

Impact

Successful exploitation allows for the acquisition of goods or services without actual financial compensation, leading to direct revenue loss for the affected site.

Recommendation

• Update the GetPaid plugin to version 2.8.63 or later immediately to resolve the input validation issue.
• Review transaction logs for invoice records where the final total is zero but associated order items represent significant value.