CVE-2026-119748

The GetPaid plugin for WordPress before 2.8.63 contains an authorization bypass vulnerability that allows unauthenticated attackers to access and manipulate another user's invoice by supplying its ID through the maybe use invoice parameter in process invoice(), bypassing the ownership and key checks performed by is authorized to pay(). Attackers can submit a known pending invoice ID via maybe use invoice to read checkout pricing details and initiate a checkout workflow, resulting in an unauthorized state change of the invoice to on-hold.