The GetPaid WordPress plugin allows an unauthenticated user to specify a pending invoice ID through the maybe_use_invoice parameter in the process_invoice() function. The plugin’s is_authorized_to_pay() check is bypassed, which lets the attacker read checkout pricing details and transition the invoice from pending to on-hold, effectively changing the invoice state without consent. This constitutes an authorization bypass that can enable data leakage and unauthorized transaction manipulation.

Any WordPress site running the GetPaid plugin prior to version 2.8.63 is vulnerable. AyeCode Ltd’s GetPaid payment, invoicing, and checkout solution is affected; the issue is limited to plugin versions below 2.8.63.

The CVSS score of 6.9 indicates moderate severity. The EPSS score is unknown, and the vulnerability is not currently listed in the CISA KEV catalog, implying no widely known exploits yet. The likely attack vector is a remote request to a publicly accessible endpoint where the attacker can supply a invoice ID via the maybe_use_invoice parameter. Because invoice identifiers are often predictable or discoverable, the exploitation risk is realistic but requires some knowledge of existing pending invoices.