Answer in brief
CVE-2026-119748 records a Medium severity (CVSS 6.9) vulnerability in GetPaid WordPress Plugin < 2.8.63 Authorization Bypass via maybe_use_invoice. The current sources do not mark it as known exploited. The current feed maps AyeCode Ltd/Payment forms, Buy now buttons, and Invoicing System | GetPaid (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
CVSS is 6.9. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps AyeCode Ltd/Payment forms, Buy now buttons, and Invoicing System | GetPaid (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| AyeCode Ltd/Payment forms, Buy now buttons, and Invoicing System | GetPaidgeneric | >=0 <2.8.63 | 2.8.63 |
Published upstream
Nov 4, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Nov 4, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Nov 4, 2026
The GetPaid plugin for WordPress before 2.8.63 contains an authorization bypass vulnerability that allows unauthenticated attackers to access and manipulate another user's invoice by supplying its ID through the maybe_use_invoice parameter in process_invoice(), bypassing the ownership and key checks performed by is_authorized_to_pay(). Attackers can submit a known pending invoice ID via maybe_use_invoice to read checkout pricing details and initiate a checkout workflow, resulting in an unauthorized state change of the invoice to on-hold.
Quoted source text, attributed separately from HOL analysis.