GetPaid (< 2.8.63) - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/products/getpaid--2.8.63/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioWed, 04 Nov 2026 18:51:08 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgGetPaid: Improper input validation leading to payment bypass (CVE-2026-119749)https://feed.craftedsignal.io/briefs/2026-11-getpaid-payment-bypass/Wed, 04 Nov 2026 18:51:08 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-11-getpaid-payment-bypass/An improper input validation vulnerability in the GetPaid WordPress plugin before 2.8.63 allows unauthenticated attackers to bypass payment requirements by submitting negative quantity values on public payment forms.The GetPaid plugin for WordPress contains an improper input validation vulnerability (CVE-2026-119749) that allows unauthenticated attackers to manipulate payment processing. By supplying a negative quantity value via a public payment form, an attacker can influence the process_item() function to generate a negative line subtotal. This result reduces the overall invoice total to zero, which subsequently triggers the process_free_payment() function to mark the invoice as paid without requiring a successful payment gateway transaction.

Impact

Successful exploitation allows for the acquisition of goods or services without actual financial compensation, leading to direct revenue loss for the affected site.

Recommendation

  • Update the GetPaid plugin to version 2.8.63 or later immediately to resolve the input validation issue.
  • Review transaction logs for invoice records where the final total is zero but associated order items represent significant value.
]]>highadvisorywordpresse-commercecve