{
 "id": "WPSEC-2026-1036",
 "url": "https://wpsec.com/vuln/WPSEC-2026-1036/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-1036/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-1036/index.md",
 "title": "GetPaid Stripe Payments <= 2.3.28 - Unauthenticated Payment Bypass via Insufficient Payment Amount Verification",
 "description": "The GetPaid Stripe Payments plugin for WordPress is vulnerable to a payment bypass via the Stripe payment intent processing (the 'payment_intent' success-page parameter, Checkout sessions and payment intent webhooks) in all versions up to, and including, 2.3.28. This is due to the process_payment_intent() function marking the invoice named in the intent's metadata as paid as soon as the intent has succeeded, without checking that the amount received and the currency match the invoice total. The intent amount comes from the checkout form data sent during price refreshes, so it can differ from the saved invoice total. This makes it possible for unauthenticated attackers, such as guest buyers, to pay less than the invoice total, or pay in a different currency, and still have the invoice marked as paid.",
 "plugin": {
  "slug": "getpaid-stripe-payments",
  "name": "GetPaid Stripe Payments",
  "full_name": "GetPaid Stripe Payments",
  "wordpress_org": "https://wordpress.org/plugins/getpaid-stripe-payments/",
  "advisories_url": "https://wpsec.com/vuln/plugin/getpaid-stripe-payments/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/getpaid-stripe-payments"
 },
 "type": "BYPASS",
 "cwe": [
  "CWE-345"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 5.3,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": null,
    "from_inclusive": true,
    "to": "2.3.29",
    "to_inclusive": false
   }
  ],
  "text": [
   "all versions before 2.3.29"
  ]
 },
 "introduced_in": null,
 "fixed_in": "2.3.29",
 "remediation": "Update to 2.3.29 or later.",
 "fix_released": "2026-10-14T15:40:00+00:00",
 "published": "2026-10-15T15:42:47+00:00",
 "updated": "2026-10-15T08:15:50.922771+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-1036/",
  "https://plugins.svn.wordpress.org/getpaid-stripe-payments/tags/2.3.29/",
  "https://wordpress.org/plugins/getpaid-stripe-payments/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/getpaid-stripe-payments",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Low",
  "affected_versions": "Low",
  "as_of": "2026-10-15"
 }
}