Payment forms, Buy now buttons, and Invoicing System | GetPaid <= 2.8.64 - Unauthenticated Price Manipulation via Fractional Item Quantity
- ID
- WPSEC-2026-2668
- Plugin
- Payment forms, Buy now buttons, and Invoicing System | GetPaid (invoicing)
- Affected
- from 2.0.8 before 2.8.65
- Remediation
- Update to 2.8.65 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
- Weakness
- CWE-1284
- Usage
- Plugin Low · Affected versions Low among sites WPSec scans, 2026-11-06
- Attack surface
- Payment forms, Buy now buttons, and Invoicing System | GetPaid on WPSec AttackSurface
- Fix released
- Published
Description
The Payment forms, Buy now buttons, and Invoicing System | GetPaid plugin for WordPress is vulnerable to price manipulation via the item quantity in payment form submissions and the item|quantity string of payment form and buy button URLs in versions 2.0.8 to, and including, 2.8.64, due to insufficient validation of item quantities, which accepted fractional values. This makes it possible for unauthenticated attackers to order an item with a tiny fractional quantity (such as 0.00001), so that the invoice total rounds down to zero and the invoice is completed as free, obtaining items without paying for them.
References
- https://wpsec.com/vuln/WPSEC-2026-2668/
- https://plugins.svn.wordpress.org/invoicing/tags/2.8.65/
- https://wordpress.org/plugins/invoicing/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS