The GetPaid plugin for WordPress contains an incorrect authorization flaw: the REST API controller maps all operations to generic WordPress post capabilities instead of the required manage_invoicing permission. An authenticated user with a lower role such as Editor or Author can therefore list other users' invoices, mark pending invoices as paid without recording a transaction, or create new invoices and published items. This flaw allows an attacker to view private financial data, tamper with invoice status, and generate fraudulent invoices, potentially compromising confidentiality, integrity, and financial correctness of the site.

AyeCode Ltd's GetPaid plugin, a WordPress payment forms and invoicing solution, is affected. All installations using a version earlier than 2.8.63 are vulnerable. Users running WordPress with the GetPaid plugin installed under these older versions are at risk.

The CVSS score of 7.1 indicates a moderate to high severity. EPSS is not available, so the current probability of exploitation is unclear; however, because the flaw involves authenticated REST API access that is typically exposed to legitimate users, it is likely to be exploitable internally. The vulnerability is not listed in the CISA KEV catalog. An attacker would need to be an authenticated user with a role such as Editor or Author. Since the REST endpoints are accessible over HTTPS, the attack can be performed from within the site’s authenticated sessions, making it relatively easy for a disgruntled employee or compromised account to exploit. The lack of an official workaround forces administrators to address the issue by applying the vendor‑supplied patch.