GetPaid accepts forged Worldpay payment notifications before 2.8.55
GetPaid before 2.8.55 lets an unauthenticated attacker submit a forged Worldpay payment notification that the plugin accepts as evidence of payment, causing a pending invoice to be marked paid even though no funds were received. The CNA identifies 2.8.55 as the first unaffected release.
- Component
- GetPaid
- Plugin slug
getpaid- Affected
- < 2.8.55
- Safe version
2.8.55- Published
- Aug 06, 2026
This CVE was published Aug 06, 2026 and is one of 3 known issues for this plugin.
Update, patch or deactivate.
Update GetPaid to 2.8.55 or later. Reconcile invoices marked paid on vulnerable versions against Worldpay transactions and revoke goods or entitlements lacking a matching payment.
A safe version is available, so updating to that version or later is the preferred remediation. If an immediate update is not practical, consider a targeted application patch or temporarily restricting the affected functionality.
Deactivate only when warranted by your risk profile, or when advised by your hosting provider in the limited circumstances where the vulnerability cannot otherwise be mitigated. If you’re unsure which action is appropriate, contact Fused or your hosting provider for guidance.
Technical description
The GetPaid WordPress plugin before 2.8.55 does not verify the authenticity of incoming Worldpay payment notifications, allowing unauthenticated attackers to forge a notification that marks a pending invoice as paid without any payment being made.
CVE / CNA vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N