GetPaid Stripe Payments <= 2.3.28 - Unauthenticated Payment Bypass via Insufficient Payment Amount Verification
- ID
- WPSEC-2026-1036
- Plugin
- GetPaid Stripe Payments (getpaid-stripe-payments)
- Affected
- all versions before 2.3.29
- Remediation
- Update to 2.3.29 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
- Weakness
- CWE-345
- Usage
- Plugin Low · Affected versions Low among sites WPSec scans, 2026-10-15
- Attack surface
- GetPaid Stripe Payments on WPSec AttackSurface
- Fix released
- Published
Description
The GetPaid Stripe Payments plugin for WordPress is vulnerable to a payment bypass via the Stripe payment intent processing (the 'payment_intent' success-page parameter, Checkout sessions and payment intent webhooks) in all versions up to, and including, 2.3.28. This is due to the process_payment_intent() function marking the invoice named in the intent's metadata as paid as soon as the intent has succeeded, without checking that the amount received and the currency match the invoice total. The intent amount comes from the checkout form data sent during price refreshes, so it can differ from the saved invoice total. This makes it possible for unauthenticated attackers, such as guest buyers, to pay less than the invoice total, or pay in a different currency, and still have the invoice marked as paid.
References
- https://wpsec.com/vuln/WPSEC-2026-1036/
- https://plugins.svn.wordpress.org/getpaid-stripe-payments/tags/2.3.29/
- https://wordpress.org/plugins/getpaid-stripe-payments/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS