5.3Orta

CVE-2026-123668GetPaid 2.8.63 - 2.8.64 - Unauthenticated Payment Bypass via Fractional Item Quantity

GetPaid Yayım: 2026-11-11 10:33 (dün)

Açıklama

The GetPaid WordPress plugin from 2.8.63 to 2.8.64 does not ensure item quantities on its payment forms are whole numbers, allowing unauthenticated users to have an invoice for a priced item marked as paid without being charged.

Zayıflık türü (CWE): CWE-1284

Veri: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Bilgiler kaynaktaki haliyle, İngilizce yayımlanır.

Etkilenen ürünler ve sürümler

Üretici	Ürün	Sürümler
—	GetPaid	2.8.63 – < 2.8.65

Kaynaklar ve yamalar

https://wpscan.com/vulnerability/62c1a6ac-0f9f-4402-b72b-8b10ffe6989c/ exploitvdb-entrytechnical-description

CVSS puanı

5.3Orta

Kaynak: WPScan · CVSS 3.1

Saldırı yolu: Ağ
Karmaşıklık: Düşük
Gereken yetki: Yok
Kullanıcı etkileşimi: Gerekmez
Kapsam: Değişmez
Gizlilik: Yok
Bütünlük: Düşük
Erişilebilirlik: Yok

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Tüm puanlar (2)

cna	CVSS 3.1	5.3Orta
contact@wpscan.com	CVSS 3.1	5.3Orta

EPSS (30 günde istismar olasılığı)

0.31%

tüm CVE'lerin %24'inden yüksek

Zaman çizelgesi

Numara ayrıldı2026-11-06
Yayımlandı2026-11-11 10:33
IP-DB'ye ulaştı2026-11-11 11:03
Son güncelleme2026-11-11 15:19

Numarayı veren (CNA): WPScan
NVD durumu: Received

Kaynakta görüntüle: CVE.org · NVD

Bu ürünlerde yeni bir açık çıktığında haber alın

E-posta uyarılarını aç

Ücretsiz · üyelikle · istediğiniz an kapatılır

Aynı üründe son açıklar — WordPress plugins & themes

8.8Yüksek

CVE-2026-125836 53 dakika önce

WordPress Simple JWT Login plugin <= 3.6.8 - Cross Site Request Forgery (CSRF) vulnerability

Nicu Micle Simple JWT Login

Cross-Site Request Forgery (CSRF) vulnerability in Nicu Micle Simple JWT Login simple-jwt-login allows Cross Site Request Forgery.This issue affects Simple JWT Login: from n/a through 3.6.8.

Puansız

CVE-2026-124817 2 saat önce

Clockinator Lite < 1.1.0 - Unauthenticated Leave Record Modification

Clockinator Lite

The Clockinator Lite WordPress plugin before 1.1.0 does not check authorisation or ownership when updating leave requests, allowing unauthenticated users to modify any leave record, including approving or rejecting requests and reassigning them to other users.

Puansız

CVE-2026-76792 2 saat önce

User Verification 2.0.38 - 2.0.48 - Unauthenticated Account Takeover via Unthrottled OTP Login Verification

User Verification by PickPlugins

The User Verification by PickPlugins WordPress plugin before 2.0.49 does not rate limit the verification step of its one-time-password login, and does not expire the generated code, allowing unauthenticated attackers to brute force it and log in as any user, …

Puansız

CVE-2026-124815 2 saat önce

Clockinator Lite < 1.1.0 - Unauthenticated SQLi via Record Deletion Actions

Clockinator Lite

The Clockinator Lite WordPress plugin before 1.1.0 does not restrict access to several of its record deletion actions, and uses a user-supplied table name in a SQL query without validating or escaping it, allowing unauthenticated users to perform SQL injectio…

Puansız

CVE-2026-124814 2 saat önce

Ultimate Addons for Elementor Forms < 1.0.8 - Unauthenticated Arbitrary File Upload via 'type' Parameter

Ultimate Addons for Elementor Forms

The Ultimate Addons for Elementor Forms WordPress plugin before 1.0.8 does not properly validate the extension of uploaded files in its bundled file upload field, allowing unauthenticated users to upload arbitrary files such as PHP scripts and achieve remote …

Puansız

CVE-2026-124665 2 saat önce

Order Tracking < 3.6.2 - Unauthenticated Customer and Sales Rep Order History Disclosure via IDOR

Order Tracking

The Order Tracking WordPress plugin before 3.6.2 does not verify that a visitor owns the customer or sales representative account whose orders they request, and the account numbers default to sequential values, allowing unauthenticated users to retrieve the …