Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-119747— GetPaid WordPress Plugin < 2.8.63 Incorrect Authorization via REST API

Quick assessment

Affected
AyeCode Ltd Payment forms, Buy now buttons, and Invoicing System | GetPaid
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

WordPress 的 GetPaid 插件在 2.8.63 版本之前存在一个授权错误漏洞。该漏洞源于 文件中的 方法，该方法将 REST 操作映射到通用的 WordPress 文章权限（post capabilities），而非强制要求插件特有的 权限。拥有较低权限角色（如编辑者 Editor 或作者 Author）的已认证用户可利用此漏洞，通过 REST API 执行以下操作：列出其他用户的发票、将待处理发票标记为已支付而不记录实际付款交易，或创建已发布的项目及新发票。

CVSS 7.1 · High

Affected Version Matrix 1

VendorProduct Version RangeStatus
AyeCode Ltd Payment forms, Buy now buttons, and Invoicing System | GetPaid < 2.8.63 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-119747

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
GetPaid WordPress Plugin < 2.8.63 Incorrect Authorization via REST API
Source: CVE Program / CVE List V5
Vulnerability Description
The GetPaid plugin for WordPress before 2.8.63 contains an incorrect authorization vulnerability where the check_post_permissions() method in includes/api/class-getpaid-rest-posts-controller.php maps REST operations to generic WordPress post capabilities instead of enforcing the plugin's manage_invoicing permission. Authenticated users with lower-privileged roles such as Editor or Author can exploit this flaw to list other users' invoices, mark pending invoices as paid without recording payment transactions, or create published items and new invoices through the REST API.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
授权机制不正确
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
AyeCode Ltd Payment forms, Buy now buttons, and Invoicing System | GetPaid 0 ~ 2.8.63 -

II. Public POCs for CVE-2026-119747

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-119747

请登录查看更多情报信息。

Other References for CVE-2026-119747 (2)

Same Patch Batch · AyeCode Ltd · 2026-11-04 · 3 CVEs total

CVE-2026-119749 7.5 HIGH GetPaid WordPress Plugin < 2.8.63 Negative Quantity Payment Bypass
CVE-2026-119748 6.5 MEDIUM GetPaid WordPress Plugin < 2.8.63 Authorization Bypass via maybe_use_invoice

IV. Related Vulnerabilities

Same product: Payment forms, Buy now buttons, and Invoicing System | GetPaid
Same vendor: AyeCode Ltd
Same weakness: CWE-863