medium5.9
CVE-2026-12901
The GetPaid WordPress plugin before 2.8.55 does not verify the authenticity of incoming Worldpay payment notifications, allowing unauthenticated attackers to f…
Impact
The GetPaid WordPress plugin before 2.8.55 does not verify the authenticity of incoming Worldpay payment notifications, allowing unauthenticated attackers to forge a notification that marks a pending invoice as paid without any payment being made.
Affected products
| Product | Affected versions |
|---|---|
| GetPaid WordPress Plugin | before 2.8.55 |
Versions were read from the advisory text. No structured product data has been published for this record yet.