Payment forms, Buy now buttons, and Invoicing System | GetPaid <= 2.8.62 - Unauthenticated Insecure Direct Object Reference to Sensitive Information Exposure via getpaid_invoice Shortcode and Embed Endpoint
- ID
- WPSEC-2026-1610
- Plugin
- Payment forms, Buy now buttons, and Invoicing System | GetPaid (invoicing)
- Affected
- from 2.6.2 before 2.8.63
- Remediation
- Update to 2.8.63 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
- Weakness
- CWE-639
- Usage
- Plugin Low · Affected versions Low among sites WPSec scans, 2026-10-25
- Attack surface
- Payment forms, Buy now buttons, and Invoicing System | GetPaid on WPSec AttackSurface
- Fix released
- Published
Description
The Payment forms, Buy now buttons, and Invoicing System | GetPaid plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions 2.6.2 to, and including, 2.8.62 via the getpaid_invoice shortcode, the Single Invoice block and widget, and the invoice embed endpoint, due to a missing check on whether the current user may view the invoice referenced by the user-controlled invoice ID. This makes it possible for unauthenticated attackers to view any customer's invoice, exposing billing details such as names, addresses, email addresses, phone numbers and purchased items, along with the invoice's private payment and receipt links.
References
- https://wpsec.com/vuln/WPSEC-2026-1610/
- https://plugins.svn.wordpress.org/invoicing/tags/2.8.63/
- https://wordpress.org/plugins/invoicing/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS