Description

The GetPaid WordPress plugin before 2.8.55 does not verify the authenticity of incoming Worldpay payment notifications, allowing unauthenticated attackers to forge a notification that marks a pending invoice as paid without any payment being made.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.9",
  "pubDate": "2026-08-06T22:16:45.457Z",
  "pubdate": "2026-08-06T22:16:45.457Z",
  "executiveSummary": "The GetPaid WordPress plugin prior to version 2.8.55 suffers from an authentication bypass vulnerability within its Worldpay payment gateway integration. The root cause stems from the application's failure to cryptographically verify or validate the authenticity of incoming asynchronous HTTP payment notification callbacks. Consequently, unauthenticated remote attackers can arbitrarily forge payment status notifications directed at the plugin's webhook endpoint.\nThe primary impact of this security flaw is unauthorized financial transaction manipulation, specifically allowing malicious actors to fraudulently transition pending invoices to a paid status without executing any legitimate monetary transactions. This integrity violation poses severe business logic and financial risks for e-commerce operators utilizing the affected plugin, as goods, services, or digital assets can be provisioned gratis.\nExploitation of this vulnerability requires no prior authentication, specific privileges, or user interaction, rendering the endpoint exposed over the network to any unauthenticated actor capable of interacting with the WordPress site. The attack complexity is low, as the adversary only needs to craft and dispatch a simulated HTTP POST request mimicking a genuine Worldpay gateway response to the vulnerable callback handler. Remediation requires updating the GetPaid plugin to version 2.8.55 or later, where proper signature verification and message authenticity checks for Worldpay notifications are implemented.",
  "technicalDetails": "The vulnerability resides within the GetPaid WordPress plugin's payment processing workflow, specifically inside the subsystem handling asynchronous webhook notifications from the Worldpay payment gateway. When a transaction occurs, the payment gateway is expected to send an HTTP callback to a designated listener URL on the WordPress site to update the order status. The technical root cause of the vulnerability is the absence of signature validation, cryptographic hashing, shared secret verification, or IP-based whitelisting mechanisms to verify that incoming notification payloads originate legitimately from Worldpay.\nBecause the vulnerable component parses incoming POST data without validating its authenticity, the application blindly trusts the parameters contained within the request body. An unauthenticated attacker can inspect the expected structure of Worldpay payment notifications—typically containing invoice identifiers, transaction states, and cryptographic fields if improperly implemented—and craft a malicious payload. By sending this forged HTTP request directly to the plugin's exposed webhook endpoint over the network, the attacker can manipulate the internal database state of the target invoice.\nThe attack flow proceeds as follows: First, the attacker identifies the public-facing listener URL used by the GetPaid plugin for Worldpay callbacks. Second, the attacker creates a pending invoice within the vulnerable WordPress installation to obtain a valid invoice identifier. Third, the attacker constructs a forged HTTP POST request containing parameters that declare the target invoice as successfully paid. Fourth, the attacker transmits this crafted payload to the plugin's webhook handler. Finally, the vulnerable component processes the request, updates the invoice status to paid in the database, and triggers any automated post-payment actions (such as generating license keys, granting user roles, or shipping physical goods) without any actual funds being transferred.\nThe affected product is the GetPaid WordPress plugin, specifically all versions prior to version 2.8.55. The vulnerability is exploitable remotely over the network with zero authentication requirements and zero privilege requirements. The post-exploitation impact includes unauthorized acquisition of goods or services, financial fraud, inventory depletion, and potential systemic business disruption due to corrupted accounting and order management data."
}