{
 "id": "WPSEC-2026-1926",
 "url": "https://wpsec.com/vuln/WPSEC-2026-1926/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-1926/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-1926/index.md",
 "title": "Payment forms, Buy now buttons, and Invoicing System | GetPaid <= 2.8.63 - Missing Authorization to Unauthenticated Sales Report Data Exposure via 'wpi_action' Parameter",
 "description": "The Payment forms, Buy now buttons, and Invoicing System | GetPaid plugin for WordPress is vulnerable to unauthorized access of data via the 'wpi_action' parameter in all versions up to, and including, 2.8.63. This is due to the wpinv_actions() function, which runs on every request, firing any 'wpinv_'-prefixed action named in the user-supplied 'wpi_action' parameter, while the Reports tab renderer hooked to one of those actions has no capability check. This makes it possible for unauthenticated attackers to render the admin Reports tab and view sales totals per item, per payment method and per discount code, including the discount codes that were used.",
 "plugin": {
  "slug": "invoicing",
  "name": "Payment forms, Buy now buttons, and Invoicing System | GetPaid",
  "full_name": "Payment forms, Buy now buttons, and Invoicing System | GetPaid",
  "wordpress_org": "https://wordpress.org/plugins/invoicing/",
  "advisories_url": "https://wpsec.com/vuln/plugin/invoicing/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/invoicing"
 },
 "type": "NO AUTHORISATION",
 "cwe": [
  "CWE-862"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 5.3,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": null,
    "from_inclusive": true,
    "to": "2.8.64",
    "to_inclusive": false
   }
  ],
  "text": [
   "all versions before 2.8.64"
  ]
 },
 "introduced_in": null,
 "fixed_in": "2.8.64",
 "remediation": "Update to 2.8.64 or later.",
 "fix_released": "2026-10-28T15:10:08+00:00",
 "published": "2026-10-29T18:50:39+00:00",
 "updated": "2026-10-29T17:43:09.542098+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-1926/",
  "https://plugins.svn.wordpress.org/invoicing/tags/2.8.64/",
  "https://wordpress.org/plugins/invoicing/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/invoicing",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Low",
  "affected_versions": "Low",
  "as_of": "2026-10-29"
 }
}