{
 "id": "WPSEC-2026-1610",
 "url": "https://wpsec.com/vuln/WPSEC-2026-1610/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-1610/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-1610/index.md",
 "title": "Payment forms, Buy now buttons, and Invoicing System | GetPaid <= 2.8.62 - Unauthenticated Insecure Direct Object Reference to Sensitive Information Exposure via getpaid_invoice Shortcode and Embed Endpoint",
 "description": "The Payment forms, Buy now buttons, and Invoicing System | GetPaid plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions 2.6.2 to, and including, 2.8.62 via the getpaid_invoice shortcode, the Single Invoice block and widget, and the invoice embed endpoint, due to a missing check on whether the current user may view the invoice referenced by the user-controlled invoice ID. This makes it possible for unauthenticated attackers to view any customer's invoice, exposing billing details such as names, addresses, email addresses, phone numbers and purchased items, along with the invoice's private payment and receipt links.",
 "plugin": {
  "slug": "invoicing",
  "name": "Payment forms, Buy now buttons, and Invoicing System | GetPaid",
  "full_name": "Payment forms, Buy now buttons, and Invoicing System | GetPaid",
  "wordpress_org": "https://wordpress.org/plugins/invoicing/",
  "advisories_url": "https://wpsec.com/vuln/plugin/invoicing/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/invoicing"
 },
 "type": "IDOR",
 "cwe": [
  "CWE-639"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 5.3,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": "2.6.2",
    "from_inclusive": true,
    "to": "2.8.63",
    "to_inclusive": false
   }
  ],
  "text": [
   "from 2.6.2 before 2.8.63"
  ]
 },
 "introduced_in": "2.6.2",
 "fixed_in": "2.8.63",
 "remediation": "Update to 2.8.63 or later.",
 "fix_released": "2026-10-23T14:59:44+00:00",
 "published": "2026-10-24T15:40:41+00:00",
 "updated": "2026-10-24T13:33:42.808344+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-1610/",
  "https://plugins.svn.wordpress.org/invoicing/tags/2.8.63/",
  "https://wordpress.org/plugins/invoicing/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/invoicing",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Low",
  "affected_versions": "Low",
  "as_of": "2026-10-25"
 }
}