The GetPaid plugin for WordPress prior to version 2.8.63 contains an improper input validation flaw that allows anyone with access to the public payment form to submit a negative quantity for an item. The unchecked quantity is processed in process_item(), resulting in a negative line subtotal that can reduce the full invoice total to zero. Because the plugin then calls process_free_payment() when the total equals zero, the invoice is marked as paid without any gateway charge. This flaw is categorized as CWE‑1284, which describes a failure to correctly validate input leading to unintended behavior. The consequence is that an attacker can trigger a complete payment bypass, potentially claiming access to services or items that would normally require a valid payment.

GetPaid, a WordPress payment and invoicing plugin developed by AyeCode Ltd, is affected when its version is earlier than 2.8.63. The vulnerability exists regardless of user authentication on the public payment interface.

The flaw carries a CVSS score of 8.7, indicating a high severity. The EPSS score is unavailable, but the lack of authentication requirement and the ease of submitting a negative quantity mean that exploitation is likely in a public setting. The vulnerability is not listed in the CISA KEV catalog, yet its potential impact on revenue and service delivery warrants immediate attention. Attackers can exploit the flaw by simply posting a crafted payment form submission, without any privileged access.