Description
The GetPaid WordPress plugin before 2.8.55 does not verify the authenticity of incoming Worldpay payment notifications, allowing unauthenticated attackers to forge a notification that marks a pending invoice as paid without any payment being made.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | GetPaid | < 2.8.55 | 2.8.55 |
References
- https://wpscan.com/vulnerability/5eb54542-4119-4d4c-8e93-e0b23cb28ae5/ exploit vdb-entry technical-description