Is CVE-2026-119748 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-119748 being exploited in the wild.

How severe is CVE-2026-119748?

Medium severity, with a CVSS score of 6.5, published 4 November 2026.

Is there a fix for CVE-2026-119748?

Yes: fixed in 2.8.63. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-119748 attacked?

It is attacked over the network.

Am I affected by CVE-2026-119748?

Check whether you run Stiofan GetPaid at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-119748: GetPaid WordPress plugin authorization bypass in invoice access

CVE-2026-119748 · Severity: medium · CVSS 6.5 · Published 2026-11-04

GetPaid is a WordPress plugin that manages online payments and invoicing for businesses. An unauthenticated attacker can bypass authorization controls to access and modify another user's invoice by directly supplying the invoice ID, allowing them to view pricing details and change an invoice's payment status without permission. This could lead to unauthorized payment state changes, fraud, or data exposure of financial information.

Technologies: Stiofan GetPaid. Vendors: Stiofan.

Quick answers

Is CVE-2026-119748 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-119748 being exploited in the wild.
How severe is CVE-2026-119748?: Medium severity, with a CVSS score of 6.5, published 4 November 2026.
Which products and versions are affected?: Stiofan GetPaid before 2.8.63.
Is there a fix for CVE-2026-119748?: Yes: fixed in 2.8.63. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-119748 attacked?: It is attacked over the network.
Am I affected by CVE-2026-119748?: Check whether you run Stiofan GetPaid at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: 2.8.63

Technical details

The vulnerability is an authorization bypass in the process_invoice() function where the maybe_use_invoice parameter is not properly validated against ownership and authorization checks. An attacker can supply a known pending invoice ID to bypass the is_authorized_to_pay() authorization function, gaining the ability to read checkout pricing and initiate state changes to on-hold status. The attack requires network access and no authentication or user interaction.

Affected products

Stiofan GetPaid before 2.8.63

Timeline

2026-11-04: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.