Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-119749— GetPaid WordPress Plugin < 2.8.63 Negative Quantity Payment Bypass

Quick assessment

Affected
AyeCode Ltd Payment forms, Buy now buttons, and Invoicing System | GetPaid
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

WordPress 的 GetPaid 插件在 2.8.63 版本之前存在输入验证不当的漏洞，允许未认证的攻击者通过在公开支付表单中提交负数的商品数量来绕过支付处理。攻击者可利用 process_item() 函数中未校验的数量值，生成负数的行小计，从而使发票总额降为零，进而触发 process_free_payment() 函数将发票标记为“已支付”，而实际上并未通过任何支付网关完成扣款。

CVSS 7.5 · High

Possible ATT&CK Techniques 1 AI

T1190 · Exploit Public-Facing Application

Affected Version Matrix 1

VendorProduct Version RangeStatus
AyeCode Ltd Payment forms, Buy now buttons, and Invoicing System | GetPaid < 2.8.63 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-119749

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
GetPaid WordPress Plugin < 2.8.63 Negative Quantity Payment Bypass
Source: CVE Program / CVE List V5
Vulnerability Description
The GetPaid plugin for WordPress before 2.8.63 contains an improper input validation vulnerability that allows unauthenticated attackers to bypass payment processing by submitting a negative item quantity on a public payment form. Attackers can exploit the unchecked quantity value in process_item() to produce a negative line subtotal that reduces the invoice total to zero, causing process_free_payment() to mark the invoice as paid without any actual gateway charge.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
CWE-1284
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
AyeCode Ltd Payment forms, Buy now buttons, and Invoicing System | GetPaid 0 ~ 2.8.63 -

II. Public POCs for CVE-2026-119749

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-119749

请登录查看更多情报信息。

Other References for CVE-2026-119749 (2)

Same Patch Batch · AyeCode Ltd · 2026-11-04 · 3 CVEs total

CVE-2026-119747 7.1 HIGH GetPaid WordPress Plugin < 2.8.63 Incorrect Authorization via REST API
CVE-2026-119748 6.5 MEDIUM GetPaid WordPress Plugin < 2.8.63 Authorization Bypass via maybe_use_invoice

IV. Related Vulnerabilities

Same product: Payment forms, Buy now buttons, and Invoicing System | GetPaid
Same vendor: AyeCode Ltd
Same weakness: CWE-1284