# Payment forms, Buy now buttons, and Invoicing System | GetPaid <= 2.8.64 - Unauthenticated Price Manipulation via Fractional Item Quantity

- **ID:** WPSEC-2026-2668
- **Plugin:** Payment forms, Buy now buttons, and Invoicing System | GetPaid (`invoicing`), https://wordpress.org/plugins/invoicing/
- **Affected versions:** from 2.0.8 before 2.8.65
- **Fixed in:** 2.8.65 (Update to 2.8.65 or later.)
- **Severity:** Medium 5.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N)
- **Weakness:** CWE-1284
- **Usage among sites WPSec scans:** plugin Low, affected versions Low (as of 2026-11-06)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/invoicing
- **Fix released:** 2026-11-05
- **Published:** 2026-11-06
- **URL:** https://wpsec.com/vuln/WPSEC-2026-2668/

## Description

The Payment forms, Buy now buttons, and Invoicing System | GetPaid plugin for WordPress is vulnerable to price manipulation via the item quantity in payment form submissions and the item|quantity string of payment form and buy button URLs in versions 2.0.8 to, and including, 2.8.64, due to insufficient validation of item quantities, which accepted fractional values. This makes it possible for unauthenticated attackers to order an item with a tiny fractional quantity (such as 0.00001), so that the invoice total rounds down to zero and the invoice is completed as free, obtaining items without paying for them.

## References

- https://wpsec.com/vuln/WPSEC-2026-2668/
- https://plugins.svn.wordpress.org/invoicing/tags/2.8.65/
- https://wordpress.org/plugins/invoicing/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-2668/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.