5.9
Medium
CVE-2026-12901 The GetPaid WordPress plugin before 2.8.55 does not verify the authenticity of incoming Worldpay payment…
Description
The GetPaid WordPress plugin before 2.8.55 does not verify the authenticity of incoming Worldpay payment notifications, allowing unauthenticated attackers to forge a notification that marks a pending invoice as paid without any payment being made.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| GetPaid 2.8 | earliest → < 2.8.55 | 2.8.55 |