# Payment forms, Buy now buttons, and Invoicing System | GetPaid <= 2.8.62 - Unauthenticated Insecure Direct Object Reference to Sensitive Information Exposure via getpaid_invoice Shortcode and Embed Endpoint

- **ID:** WPSEC-2026-1610
- **Plugin:** Payment forms, Buy now buttons, and Invoicing System | GetPaid (`invoicing`), https://wordpress.org/plugins/invoicing/
- **Affected versions:** from 2.6.2 before 2.8.63
- **Fixed in:** 2.8.63 (Update to 2.8.63 or later.)
- **Severity:** Medium 5.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N)
- **Weakness:** CWE-639
- **Usage among sites WPSec scans:** plugin Low, affected versions Low (as of 2026-10-25)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/invoicing
- **Fix released:** 2026-10-23
- **Published:** 2026-10-24
- **URL:** https://wpsec.com/vuln/WPSEC-2026-1610/

## Description

The Payment forms, Buy now buttons, and Invoicing System | GetPaid plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions 2.6.2 to, and including, 2.8.62 via the getpaid_invoice shortcode, the Single Invoice block and widget, and the invoice embed endpoint, due to a missing check on whether the current user may view the invoice referenced by the user-controlled invoice ID. This makes it possible for unauthenticated attackers to view any customer's invoice, exposing billing details such as names, addresses, email addresses, phone numbers and purchased items, along with the invoice's private payment and receipt links.

## References

- https://wpsec.com/vuln/WPSEC-2026-1610/
- https://plugins.svn.wordpress.org/invoicing/tags/2.8.63/
- https://wordpress.org/plugins/invoicing/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-1610/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.