Threats tagged 'ghsa-hr58-8ppj-xwvg'

The GetPaid plugin for WordPress versions prior to 2.8.63 contains an authorization bypass vulnerability. This flaw allows unauthenticated attackers to access and manipulate invoices belonging to other users by exploiting the maybe_use_invoice parameter. By supplying a known pending invoice ID, attackers can read checkout pricing details and change the invoice status to on-hold without proper authorization.