EUVD-2026-54190
GHSA-w426-cmgx-r837
Severity by source
AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N
Network-reachable webhook with no auth required; AC:H because attacker must know invoice ID and reconstruct Worldpay notification format; integrity-only impact with no confidentiality or availability effect.
Primary rating from Vendor (wpscan).
CVSS VectorVendor: wpscan
Lifecycle Timeline
3DescriptionCVE.org
The GetPaid WordPress plugin before 2.8.55 does not verify the authenticity of incoming Worldpay payment notifications, allowing unauthenticated attackers to forge a notification that marks a pending invoice as paid without any payment being made.
AnalysisAI
Payment fraud via forged Worldpay webhooks affects the GetPaid WordPress plugin before version 2.8.55, allowing unauthenticated remote attackers to mark pending invoices as paid without making any actual payment. The plugin fails to verify the authenticity of incoming Worldpay Instant Payment Notifications (IPNs), meaning any attacker who can reach the webhook endpoint and reconstruct a plausible notification payload can manipulate invoice status. No public exploit has been identified at time of analysis, but the business logic impact - obtaining goods or services without payment - is direct and immediately harmful to affected merchants.
Technical ContextAI
GetPaid is a WordPress invoicing and payment plugin that integrates with multiple payment gateways, including Worldpay. Payment gateways like Worldpay use server-to-server callback notifications (IPNs or webhooks) to asynchronously confirm transaction outcomes. Secure implementations validate these callbacks using a shared secret or cryptographic signature to confirm the notification originated from the payment processor. The root cause here - while no CWE is formally assigned - maps closely to CWE-345 (Insufficient Verification of Data Authenticity) or CWE-940 (Improper Verification of Source of a Communication Channel). The affected component is the Worldpay notification handler within GetPaid versions prior to 2.8.55. CPE-equivalent scope per EUVD data: GetPaid plugin versions 0 through 2.8.54 inclusive.
RemediationAI
Upgrade the GetPaid WordPress plugin to version 2.8.55 or later, which introduces proper verification of Worldpay payment notification authenticity. The patch is confirmed available per vendor advisory referenced via WPScan (https://wpscan.com/vulnerability/5eb54542-4119-4d4c-8e93-e0b23cb28ae5/); the exact fix mechanism is not independently detailed in available references, but version 2.8.55 is the confirmed remediation boundary per EUVD-2026-54190. As an interim workaround for sites unable to update immediately, temporarily disabling the Worldpay payment gateway within GetPaid settings will prevent the vulnerable webhook handler from being reachable, at the cost of losing Worldpay as a payment option. Operators should also audit recent invoice status changes for unexpected 'paid' transitions on previously pending invoices to identify potential retroactive abuse.
The mailSend function in the isMail transport in PHPMailer before 5.2.18 might allow remote attackers to pass extra para
The isMail transport in PHPMailer before 5.2.20 might allow remote attackers to pass extra parameters to the mail comman
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
The Hash Form - Drag & Drop Form Builder plugin for WordPress is vulnerable to arbitrary file uploads due to missing fil
Authentication bypass in the LiteSpeed Cache WordPress plugin (versions prior to 6.5.0.1) allows unauthenticated remote
The GiveWP - Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to PHP Object Injection in all
The Simple File List plugin for WordPress through version 4.2.2 contains an unauthenticated remote code execution vulner
The AI Engine WordPress plugin through version 3.1.3 exposes Bearer Token values through the /mcp/v1/ REST API endpoint
The SureTriggers WordPress plugin through version 1.0.82 contains a privilege escalation vulnerability that allows unaut
The Ninja Forms plugin before 2.9.42.1 for WordPress allows remote attackers to conduct PHP object injection attacks via
The Business Directory Plugin - Easy Listing Directories for WordPress plugin for WordPress is vulnerable to time-based
Remote code execution in WordPress 6.9.x (before 6.9.5) and 7.0.x (before 7.0.2) arises from a REST API batch endpoint r
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today