CVE-2026-119749highCWE-1284

CVE-2026-119749: falha de alta gravidade em AyeCode Ltd Payment forms, Buy now buttons…

GetPaid WordPress Plugin < 2.8.63 Negative Quantity Payment Bypass

Publicada em

Seguir esta CVE+ Monitorar Payment forms, Buy now buttons, and Invoicing System | GetPaid

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

21Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 8.7epss 0.4%
The GetPaid plugin for WordPress before 2.8.63 contains an improper input validation vulnerability that allows unauthenticated attackers to bypass payment processing by submitting a negative item quantity on a public payment form. Attackers can exploit the unchecked quantity value in process_item() to produce a negative line subtotal that reduces the invoice total to zero, causing process_free_payment() to mark the invoice as paid without any actual gateway charge.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N
Produtos afetados
AyeCode Ltd · Payment forms, Buy now buttons, and Invoicing System | GetPaid
CVEs relacionadas — AyeCode Ltd Payment forms, Buy now buttons…

No mesmo produto, das mais perigosas para as menos.

CVE-2026-119748MEDIUMGetPaid WordPress Plugin < 2.8.63 Authorization Bypass via maybe_use_invoiceEPSS 0.2%CVE-2026-119747HIGHGetPaid WordPress Plugin < 2.8.63 Incorrect Authorization via REST APIEPSS 0.2%