{"id":"CVE-2026-123668","aliases":["EUVD-2026-123278","GHSA-gph4-x2p9-rpr7"],"status":"published","title":"GetPaid 2.8.63 - 2.8.64 - Unauthenticated Payment Bypass via Fractional Item Quantity","description":"The GetPaid WordPress plugin from 2.8.63 to 2.8.64 does not ensure item quantities on its payment forms are whole numbers, allowing unauthenticated users to have an invoice for a priced item marked as paid without being charged.","severity":{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-12","score":0.0031,"percentile":0.24223,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-1284"],"published":"2026-11-11T07:33:09Z","modified":"2026-11-11T12:31:40Z","products":[{"vendor":"ayecode ltd","product":"getpaid"},{"vendor":"unknown","product":"getpaid"}],"references":[{"url":"https://wpscan.com/vulnerability/62c1a6ac-0f9f-4402-b72b-8b10ffe6989c/","tags":["exploit","vdb-entry","technical-description"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-123668"},{"url":"https://wpscan.com/vulnerability/62c1a6ac-0f9f-4402-b72b-8b10ffe6989c"},{"url":"https://github.com/advisories/GHSA-gph4-x2p9-rpr7"}],"sources":{"cve":[{"id":"CVE-2026-123668","title":"GetPaid 2.8.63 - 2.8.64 - Unauthenticated Payment Bypass via Fractional Item Quantity","description":"The GetPaid WordPress plugin from 2.8.63 to 2.8.64 does not ensure item quantities on its payment forms are whole numbers, allowing unauthenticated users to have an invoice for a priced item marked as paid without being charged.","status":"published","published":"2026-11-11T07:33:09.445Z","modified":"2026-11-11T11:14:26.725Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-1284"],"updated_at":"2026-11-11T12:57:43.416809Z"}],"euvd":[{"id":"EUVD-2026-123278","description":"The GetPaid WordPress plugin from 2.8.63 to 2.8.64 does not ensure item quantities on its payment forms are whole numbers, allowing unauthenticated users to have an invoice for a priced item marked as paid without being charged.","status":"published","published":"2026-11-11T07:33:09Z","modified":"2026-11-11T11:14:26Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"updated_at":"2026-11-11T11:28:20.213197Z"}],"ghsa":[{"id":"GHSA-gph4-x2p9-rpr7","title":"The GetPaid WordPress plugin from 2.8.63 to 2.8.64 does not ensure item quantities on its payment...","description":"The GetPaid WordPress plugin from 2.8.63 to 2.8.64 does not ensure item quantities on its payment forms are whole numbers, allowing unauthenticated users to have an invoice for a priced item marked as paid without being charged.","status":"published","published":"2026-11-11T09:31:28Z","modified":"2026-11-11T12:31:40Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"cwes":["CWE-1284"],"updated_at":"2026-11-11T12:34:05.637143Z"}],"nvd":[{"id":"CVE-2026-123668","description":"The GetPaid WordPress plugin from 2.8.63 to 2.8.64 does not ensure item quantities on its payment forms are whole numbers, allowing unauthenticated users to have an invoice for a priced item marked as paid without being charged.","status":"published","published":"2026-11-11T08:17:17.833Z","modified":"2026-11-12T18:49:18.84Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-1284"],"updated_at":"2026-11-11T14:25:07.037694Z"}]}}