# Payment forms, Buy now buttons, and Invoicing System | GetPaid <= 2.8.62 - Unauthenticated Insecure Direct Object Reference to Invoice Modification via maybe_use_invoice Parameter

- **ID:** WPSEC-2026-1611
- **Plugin:** Payment forms, Buy now buttons, and Invoicing System | GetPaid (`invoicing`), https://wordpress.org/plugins/invoicing/
- **Affected versions:** from 2.7.0 before 2.8.63
- **Fixed in:** 2.8.63 (Update to 2.8.63 or later.)
- **Severity:** Medium 5.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N)
- **Weakness:** CWE-639
- **Usage among sites WPSec scans:** plugin Low, affected versions Low (as of 2026-10-25)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/invoicing
- **Fix released:** 2026-10-23
- **Published:** 2026-10-24
- **URL:** https://wpsec.com/vuln/WPSEC-2026-1611/

## Description

The Payment forms, Buy now buttons, and Invoicing System | GetPaid plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions 2.7.0 to, and including, 2.8.62 via the 'maybe_use_invoice' payment form parameter, due to a missing check on whether the submitter may pay the referenced draft or pending invoice. This makes it possible for unauthenticated attackers to take over another customer's unpaid invoice at checkout and overwrite its items, email address and billing details.

## References

- https://wpsec.com/vuln/WPSEC-2026-1611/
- https://plugins.svn.wordpress.org/invoicing/tags/2.8.63/
- https://wordpress.org/plugins/invoicing/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-1611/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.