CVE-2026-12901 — GetPaid < 2.8.55 - Unauthenticated Worldpay Payment Bypass via Insufficient IPN Verification

CVE-2026-12901

GetPaid < 2.8.55 - Unauthenticated Worldpay Payment Bypass via Insufficient IPN Verification PUBLISHED

Description (CNA)

The GetPaid WordPress plugin before 2.8.55 does not verify the authenticity of incoming Worldpay payment notifications, allowing unauthenticated attackers to forge a notification that marks a pending invoice as paid without any payment being made.

Affected (CNA)

Vendor / product	Versions
Unknown / GetPaid	affected 0 before 2.8.55

CWE

No CWE identifiers supplied.

References

https://wpscan.com/vulnerability/5eb54542-4119-4d4c-8e93-e0b23cb28ae5/

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.