Threats tagged 'ghsa-jf75-578j-f2xq'

The GetPaid WordPress plugin before version 2.8.63 has an authorization vulnerability due to improper permission checks in its REST API. This flaw allows authenticated users with roles like Editor or Author to access and manipulate invoices they should not control, including listing other users' invoices, marking pending invoices as paid without proper transaction records, and creating published items and invoices.