# Payment forms, Buy now buttons, and Invoicing System | GetPaid <= 2.8.54 - Unauthenticated Missing Authorization to Invoice Payment via Test Gateway

- **ID:** WPSEC-2026-1613
- **Plugin:** Payment forms, Buy now buttons, and Invoicing System | GetPaid (`invoicing`), https://wordpress.org/plugins/invoicing/
- **Affected versions:** all versions before 2.8.55
- **Fixed in:** 2.8.55 (Update to 2.8.55 or later.)
- **Severity:** Medium 5.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N)
- **Weakness:** CWE-862
- **Usage among sites WPSec scans:** plugin Low, affected versions Low (as of 2026-10-25)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/invoicing
- **Fix released:** 2026-07-08
- **Published:** 2026-10-24
- **URL:** https://wpsec.com/vuln/WPSEC-2026-1613/

## Description

The Payment forms, Buy now buttons, and Invoicing System | GetPaid plugin for WordPress is vulnerable to unauthorized invoice payment via the Test Gateway in all versions up to, and including, 2.8.54, due to the Test Gateway being active by default and its payment processing lacking any capability check. This makes it possible for unauthenticated attackers to check out with the Test Gateway and have invoices marked as paid without making a payment, on sites where the Test Gateway has not been disabled.

## References

- https://wpsec.com/vuln/WPSEC-2026-1613/
- https://plugins.svn.wordpress.org/invoicing/tags/2.8.55/
- https://wordpress.org/plugins/invoicing/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-1613/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.