Vulnerabilities / Payment forms, Buy now buttons, and Invoicing System | GetPaid / WPSEC-2026-1611
Payment forms, Buy now buttons, and Invoicing System | GetPaid <= 2.8.62 - Unauthenticated Insecure Direct Object Reference to Invoice Modification via maybe_use_invoice Parameter
Medium 5.3
CWE-639Fixed in 2.8.63
- ID
- WPSEC-2026-1611
- Plugin
- Payment forms, Buy now buttons, and Invoicing System | GetPaid (invoicing)
- Affected
- from 2.7.0 before 2.8.63
- Remediation
- Update to 2.8.63 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
- Weakness
- CWE-639
- Usage
- Plugin Low · Affected versions Low among sites WPSec scans, 2026-10-25
- Attack surface
- Payment forms, Buy now buttons, and Invoicing System | GetPaid on WPSec AttackSurface
- Fix released
- Published
Description
The Payment forms, Buy now buttons, and Invoicing System | GetPaid plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions 2.7.0 to, and including, 2.8.62 via the 'maybe_use_invoice' payment form parameter, due to a missing check on whether the submitter may pay the referenced draft or pending invoice. This makes it possible for unauthenticated attackers to take over another customer's unpaid invoice at checkout and overwrite its items, email address and billing details.
References
- https://wpsec.com/vuln/WPSEC-2026-1611/
- https://plugins.svn.wordpress.org/invoicing/tags/2.8.63/
- https://wordpress.org/plugins/invoicing/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS