GetPaid CVE-2026-49064

The target site must have the Stiofan GetPaid / Invoicing WordPress plugin installed and active at any version up to and including 2.8.49, and the vulnerable endpoint (REST route, AJAX action, or rendered view that embeds the sensitive fields) must be reachable from the attacker's network - i.e., the WordPress site is exposed to the internet or to the attacker's segment. Per CVSS PR:N/UI:N/AC:L, no authentication, no user interaction, and no special timing or race condition are required. Limiting factors are deployment-side rather than vulnerability-side: sites that have removed/deactivated GetPaid, that gate wp-json/ and admin-ajax.php behind authentication or a WAF, or that have no invoice/customer data populated yet will see reduced practical impact even though the code path remains technically reachable.

Signals are mixed and lean toward 'serious but not emergency.' CVSS 7.5 is driven entirely by High confidentiality impact with no integrity or availability impact, over a fully remote, low-complexity, unauthenticated, no-user-interaction vector (AV:N/AC:L/PR:N/UI:N/C:H/I:N/A:N) - meaning any internet-reachable vulnerable site can be probed at scale. Counterweights: there is no CISA KEV listing, no published EPSS score in the input, no SSVC decision, and no public POC referenced beyond the Patchstack advisory; the exact data category exposed ('embedded sensitive data') is not specified, so the High confidentiality rating reflects a worst-case interpretation rather than confirmed leakage of credentials or PII. Conflict to flag: the description gives no detail on which endpoint or data class is affected, so defenders cannot independently validate the C:H rating without the Patchstack advisory body. Treat as a prompt-patch issue for any site running GetPaid, especially e-commerce/invoicing deployments where leaked invoice or customer data has direct privacy and regulatory consequences.

An attacker enumerates WordPress sites running the GetPaid (Invoicing) plugin via fingerprinting (readme.txt, asset URLs, REST namespaces), then issues unauthenticated HTTP requests to the vulnerable endpoint and parses sensitive fields embedded in the response - for example invoice metadata, customer details, or internal configuration - to harvest data at scale across many sites. No user interaction or authentication is required per the CVSS vector, and no public exploit identified at time of analysis means initial discovery would likely come from the Patchstack write-up.