{
 "id": "WPSEC-2026-1611",
 "url": "https://wpsec.com/vuln/WPSEC-2026-1611/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-1611/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-1611/index.md",
 "title": "Payment forms, Buy now buttons, and Invoicing System | GetPaid <= 2.8.62 - Unauthenticated Insecure Direct Object Reference to Invoice Modification via maybe_use_invoice Parameter",
 "description": "The Payment forms, Buy now buttons, and Invoicing System | GetPaid plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions 2.7.0 to, and including, 2.8.62 via the 'maybe_use_invoice' payment form parameter, due to a missing check on whether the submitter may pay the referenced draft or pending invoice. This makes it possible for unauthenticated attackers to take over another customer's unpaid invoice at checkout and overwrite its items, email address and billing details.",
 "plugin": {
  "slug": "invoicing",
  "name": "Payment forms, Buy now buttons, and Invoicing System | GetPaid",
  "full_name": "Payment forms, Buy now buttons, and Invoicing System | GetPaid",
  "wordpress_org": "https://wordpress.org/plugins/invoicing/",
  "advisories_url": "https://wpsec.com/vuln/plugin/invoicing/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/invoicing"
 },
 "type": "IDOR",
 "cwe": [
  "CWE-639"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 5.3,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": "2.7.0",
    "from_inclusive": true,
    "to": "2.8.63",
    "to_inclusive": false
   }
  ],
  "text": [
   "from 2.7.0 before 2.8.63"
  ]
 },
 "introduced_in": "2.7.0",
 "fixed_in": "2.8.63",
 "remediation": "Update to 2.8.63 or later.",
 "fix_released": "2026-10-23T14:59:44+00:00",
 "published": "2026-10-24T15:40:41+00:00",
 "updated": "2026-10-24T13:33:42.808344+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-1611/",
  "https://plugins.svn.wordpress.org/invoicing/tags/2.8.63/",
  "https://wordpress.org/plugins/invoicing/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/invoicing",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Low",
  "affected_versions": "Low",
  "as_of": "2026-10-25"
 }
}