CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N
What the vulnerability does
The GetPaid WordPress plugin before 2.8.55 does not verify the authenticity of incoming Worldpay payment notifications, allowing unauthenticated attackers to forge a notification that marks a pending invoice as paid without any payment being made.
Explanation of Vulnerability in Simple Terms
GetPaid versions before 2.8.55 contain an integrity vulnerability that allows an attacker to modify data or functionality without authentication. The attack requires specific network conditions and cannot be exploited remotely without additional setup. No confidentiality or availability impact occurs. Update to version 2.8.55 or later to resolve this issue.
What an attacker can do
Modify or tamper with site data or functionality without needing to log in.
Potential impact on your site
Unauthorized changes to site data or behavior; integrity of transactions or settings cannot be guaranteed.
Conditions required to exploit
Attacker must have network access and meet specific technical conditions; no user interaction required.
Key dates
External resources
