Threats tagged 'ghsa-mxp8-89wv-42r2'

The GetPaid plugin for WordPress versions before 2.8.63 has an input validation vulnerability that allows unauthenticated attackers to bypass payment processing. By submitting a negative item quantity on a public payment form, attackers can reduce the invoice total to zero, causing the system to mark the invoice as paid without charging the payment gateway.