{
 "id": "WPSEC-2026-1608",
 "url": "https://wpsec.com/vuln/WPSEC-2026-1608/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-1608/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-1608/index.md",
 "title": "Payment forms, Buy now buttons, and Invoicing System | GetPaid <= 2.8.62 - Unauthenticated Payment Bypass via PayPal IPN Amount, Currency and Receiver Validation",
 "description": "The Payment forms, Buy now buttons, and Invoicing System | GetPaid plugin for WordPress is vulnerable to Payment Bypass via the PayPal IPN handler in all versions up to, and including, 2.8.62, due to a mismatched amount or currency on one-time payment notifications, and a mismatched receiving PayPal account or currency on subscription payment notifications, not stopping the invoice from being treated as paid. This makes it possible for unauthenticated attackers to have invoices marked as paid after a PayPal payment in another currency or to a different PayPal account, or, for one-time payments, of a lower amount.",
 "plugin": {
  "slug": "invoicing",
  "name": "Payment forms, Buy now buttons, and Invoicing System | GetPaid",
  "full_name": "Payment forms, Buy now buttons, and Invoicing System | GetPaid",
  "wordpress_org": "https://wordpress.org/plugins/invoicing/",
  "advisories_url": "https://wpsec.com/vuln/plugin/invoicing/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/invoicing"
 },
 "type": "BYPASS",
 "cwe": [
  "CWE-345"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 5.3,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": null,
    "from_inclusive": true,
    "to": "2.8.63",
    "to_inclusive": false
   }
  ],
  "text": [
   "all versions before 2.8.63"
  ]
 },
 "introduced_in": null,
 "fixed_in": "2.8.63",
 "remediation": "Update to 2.8.63 or later.",
 "fix_released": "2026-10-23T14:59:44+00:00",
 "published": "2026-10-24T15:40:41+00:00",
 "updated": "2026-10-24T13:33:42.808344+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-1608/",
  "https://plugins.svn.wordpress.org/invoicing/tags/2.8.63/",
  "https://wordpress.org/plugins/invoicing/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/invoicing",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Low",
  "affected_versions": "Low",
  "as_of": "2026-10-25"
 }
}