Vulnerability · Published Nov 4, 2026 · Assigned by VulnCheck

CVE-2026-119749GetPaid WordPress Plugin < 2.8.63 Negative Quantity Payment Bypass

High 7.5

In plain English

A high-severity security flaw in Payment forms, Buy now buttons, and Invoicing System | GetPaid from AyeCode Ltd. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 30% of all known vulnerabilities).

Severity (CVSS 3.1)7.5High

Exploit odds (30 days)0.4%top 69.7% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

The GetPaid plugin for WordPress before 2.8.63 contains an improper input validation vulnerability that allows unauthenticated attackers to bypass payment processing by submitting a negative item quantity on a public payment form. Attackers can exploit the unchecked quantity value in process_item() to produce a negative line subtotal that reduces the invoice total to zero, causing process_free_payment() to mark the invoice as paid without any actual gateway charge.

Affected products (as reported)

Vendor	Product	Versions
AyeCode Ltd	Payment forms, Buy now buttons, and Invoicing System \| GetPaid	0 – before 2.8.63

Weakness: CWE-1284 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

References

WordPress Changelog release-notes, patch
VulnCheck Advisory: GetPaid WordPress Plugin < 2.8.63 Negative Quantity Payment Bypass third-party-advisory