# Payment forms, Buy now buttons, and Invoicing System | GetPaid <= 2.8.64 - Unauthenticated Payment Bypass via PayPal Standard Subscription Amount Tampering

- **ID:** WPSEC-2026-2669
- **Plugin:** Payment forms, Buy now buttons, and Invoicing System | GetPaid (`invoicing`), https://wordpress.org/plugins/invoicing/
- **Affected versions:** all versions before 2.8.65
- **Fixed in:** 2.8.65 (Update to 2.8.65 or later.)
- **Severity:** Medium 5.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N)
- **Weakness:** CWE-345
- **Usage among sites WPSec scans:** plugin Low, affected versions Low (as of 2026-11-06)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/invoicing
- **Fix released:** 2026-11-05
- **Published:** 2026-11-06
- **URL:** https://wpsec.com/vuln/WPSEC-2026-2669/

## Description

The Payment forms, Buy now buttons, and Invoicing System | GetPaid plugin for WordPress is vulnerable to payment bypass via the PayPal Standard IPN handler in all versions up to, and including, 2.8.64, due to the subscription signup and first subscription payment notification handlers activating the subscription and marking the invoice paid without checking the recurring amount, first-payment amount, billing period or amount charged against the invoice. Because the PayPal Standard subscription form is submitted from the customer's browser, this makes it possible for unauthenticated attackers to change the subscription terms before paying and have a subscription activated, with its invoice marked paid, at a lower price than the invoice total. Exploitation requires the PayPal Standard gateway to be enabled and a recurring item to be purchasable.

## References

- https://wpsec.com/vuln/WPSEC-2026-2669/
- https://plugins.svn.wordpress.org/invoicing/tags/2.8.65/
- https://wordpress.org/plugins/invoicing/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-2669/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.