CVE-2026-12901

—

CVSS 3.1

5.9 medium

EPSS

<1%p3

Published

Aug 6, 2026 (Aug 6, 2026)

Modified

Aug 26, 2026

Description

The GetPaid WordPress plugin before 2.8.55 does not verify the authenticity of incoming Worldpay payment notifications, allowing unauthenticated attackers to forge a notification that marks a pending invoice as paid without any payment being made.

Ecosystems: WordPress
Weakness: CWE-345
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N

NVD CVE.org GitHub PoCs EPSS (0.1%)

In the news0 stories

No ingested article mentions this CVE yet.