CVE-2026-119749High· 7.5▾ TwilightThe GetPaid plugin for WordPress before 2.8.63 contains an improper input validation vulnerability that allows unauthenticated attackers to bypass payment processing by submitting a negative item quantity on a public payment form. Attack…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 41.3 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake. The CVSS score shown above comes from the assigning CNA record, not NVD.
The GetPaid plugin for WordPress before 2.8.63 contains an improper input validation vulnerability that allows unauthenticated attackers to bypass payment processing by submitting a negative item quantity on a public payment form. Attackers can exploit the unchecked quantity value in process_item() to produce a negative line subtotal that reduces the invoice total to zero, causing process_free_payment() to mark the invoice as paid without any actual gateway charge.
payment_forms_buy_now_buttons_and_invoicing_system_getpaid < 2.8.63Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-119748Medium· 6.5GetPaid WordPress Plugin < 2.8.63 Authorization Bypass via maybe_use_invoice
CVE-2026-119747High· 7.1GetPaid WordPress Plugin < 2.8.63 Incorrect Authorization via REST API
CVE-2026-111110High· 7.2Payment forms, Buy now buttons, and Invoicing System | GetPaid <= 2.8.61 - Unauthenticated Stored Cross-Site Scripting via 'mmdwqzpoxadd' Parameter
CVE-2026-8813High· 7.5This affects versions of the package exifreader before 4.39.0
CVE-2026-94395High· 7.0Stack-based buffer overflow in SafeNet Authentication Client SIS token engine
CVE-2026-70659High· 7.8stable-diffusion.cpp: Heap out-of-bounds write in the imatrix loader (`load_imatrix`) via a duplicate tensor name