https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Mon, 09 Nov 2026 18:32:42 +0000 https://db.gcve.eu/vuln/fkie_cve-2026-119747 <p>The GetPaid plugin for WordPress before 2.8.63 contains an incorrect authorization vulnerability where the check_post_permissions() method in includes/api/class-getpaid-rest-posts-controller.php maps REST operations to generic WordPress post capabilities instead of enforcing the plugin&#39;s manage_invoicing permission. Authenticated users with lower-privileged roles such as Editor or Author can exploit this flaw to list other users&#39; invoices, mark pending invoices as paid without recording payment transactions, or create published items and new invoices through the REST API.</p> <p>The GetPaid plugin for WordPress before 2.8.63 contains an incorrect authorization vulnerability where the check_post_permissions() method in includes/api/class-getpaid-rest-posts-controller.php maps REST operations to generic WordPress post capabilities instead of enforcing the plugin&#39;s manage_invoicing permission. Authenticated users with lower-privileged roles such as Editor or Author can exploit this flaw to list other users&#39; invoices, mark pending invoices as paid without recording payment transactions, or create published items and new invoices through the REST API.</p> https://db.gcve.eu/vuln/fkie_cve-2026-119747 https://db.gcve.eu/vuln/ghsa-jf75-578j-f2xq <p>The GetPaid plugin for WordPress before 2.8.63 contains an incorrect authorization vulnerability where the check_post_permissions() method in includes/api/class-getpaid-rest-posts-controller.php maps REST operations to generic WordPress post capabilities instead of enforcing the plugin&#39;s manage_invoicing permission. Authenticated users with lower-privileged roles such as Editor or Author can exploit this flaw to list other users&#39; invoices, mark pending invoices as paid without recording payment transactions, or create published items and new invoices through the REST API.</p> <p>The GetPaid plugin for WordPress before 2.8.63 contains an incorrect authorization vulnerability where the check_post_permissions() method in includes/api/class-getpaid-rest-posts-controller.php maps REST operations to generic WordPress post capabilities instead of enforcing the plugin&#39;s manage_invoicing permission. Authenticated users with lower-privileged roles such as Editor or Author can exploit this flaw to list other users&#39; invoices, mark pending invoices as paid without recording payment transactions, or create published items and new invoices through the REST API.</p> https://db.gcve.eu/vuln/ghsa-jf75-578j-f2xq