# GetPaid Stripe Payments <= 2.3.28 - Unauthenticated Payment Bypass via Insufficient Payment Amount Verification

- **ID:** WPSEC-2026-1036
- **Plugin:** GetPaid Stripe Payments (`getpaid-stripe-payments`), https://wordpress.org/plugins/getpaid-stripe-payments/
- **Affected versions:** all versions before 2.3.29
- **Fixed in:** 2.3.29 (Update to 2.3.29 or later.)
- **Severity:** Medium 5.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N)
- **Weakness:** CWE-345
- **Usage among sites WPSec scans:** plugin Low, affected versions Low (as of 2026-10-15)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/getpaid-stripe-payments
- **Fix released:** 2026-10-14
- **Published:** 2026-10-15
- **URL:** https://wpsec.com/vuln/WPSEC-2026-1036/

## Description

The GetPaid Stripe Payments plugin for WordPress is vulnerable to a payment bypass via the Stripe payment intent processing (the 'payment_intent' success-page parameter, Checkout sessions and payment intent webhooks) in all versions up to, and including, 2.3.28. This is due to the process_payment_intent() function marking the invoice named in the intent's metadata as paid as soon as the intent has succeeded, without checking that the amount received and the currency match the invoice total. The intent amount comes from the checkout form data sent during price refreshes, so it can differ from the saved invoice total. This makes it possible for unauthenticated attackers, such as guest buyers, to pay less than the invoice total, or pay in a different currency, and still have the invoice marked as paid.

## References

- https://wpsec.com/vuln/WPSEC-2026-1036/
- https://plugins.svn.wordpress.org/getpaid-stripe-payments/tags/2.3.29/
- https://wordpress.org/plugins/getpaid-stripe-payments/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-1036/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.