Vulnerability in Ayecode Ltd Payment Forms, Buy Now Buttons, And Invoicing System | Getpaid
CVE-2026-119749
The GetPaid plugin for WordPress before 2.8.63 contains an improper input validation vulnerability that allows unauthenticated attackers to bypass payment processing by submitting a negative item quantity on a public payment form. Attackers can exploit the unchecked quantity value in process_item() to produce a negative line subtotal that reduces the invoice total to zero, causing process_free_payment() to mark the invoice as paid without any actual gateway charge.
Published · last modified .
CVSS v3 metric
CVSS v3 base score 7.5 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N.
EPSS exploit prediction
No EPSS score from FIRST.org yet. New CVEs usually get one within a few days; no score means no signal yet, not low risk. How EPSS works.
Affected products
Weakness classification (CWE)
References
- WordPress Changelog (release-notes, patch)
- VulnCheck Advisory: GetPaid WordPress Plugin < 2.8.63 Negative Quantity Payment Bypass (third-party-advisory)
Frequently asked questions
- What is CVE-2026-119749?
- CVE-2026-119749 is a high-severity vulnerability in Ayecode Ltd Payment Forms, Buy Now Buttons, And Invoicing System | Getpaid, classified under Improper Validation of Specified Quantity in Input. CVSS score: 7.5/10. Published 2026-11-04.
- How severe is CVE-2026-119749?
- High severity. CVSS v3 base score is 7.5 out of 10.