CVE-2026-123668

GetPaid 2.8.63 - 2.8.64 - Unauthenticated Payment Bypass via Fractional Item Quantity

medium · 5.3

Fix listed

GetPaid

Published Nov 11, 2026, 07:33 UTC

Description

The GetPaid WordPress plugin from 2.8.63 to 2.8.64 does not ensure item quantities on its payment forms are whole numbers, allowing unauthenticated users to have an invoice for a priced item marked as paid without being charged.

Reported fixed versions

2.8.65

Official CVE record Read Eden case study View source and advisories

Data from cve.now. Summaries, where shown, are licensed CC BY 4.0.