What is GHSA-gph4-x2p9-rpr7?

GHSA-gph4-x2p9-rpr7 is a security advisory published by GitHub Security Advisories with Medium severity. The GetPaid WordPress plugin from 2.8.63 to 2.8.64 does not ensure item quantities on its payment...

Which CVE IDs does GHSA-gph4-x2p9-rpr7 cover?

GHSA-gph4-x2p9-rpr7 covers the following CVE IDs: CVE-2026-123668. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-gph4-x2p9-rpr7?

GHSA-gph4-x2p9-rpr7 has a CVSS v3 base score of 5.3, published by GitHub Security Advisories.

GHSA-gph4-x2p9-rpr7MediumCVSS 5.3

The GetPaid WordPress plugin from 2.8.63 to 2.8.64 does not ensure item quantities on its payment...

Vendor

GitHub Security Advisories

Published

November 11, 2026

Last Modified

November 11, 2026

🔗 CVE IDs covered (1)

CVE-2026-123668 →

📋 Description

The GetPaid WordPress plugin from 2.8.63 to 2.8.64 does not ensure item quantities on its payment forms are whole numbers, allowing unauthenticated users to have an invoice for a priced item marked as paid without being charged.

🔗 References (3)

https://nvd.nist.gov/vuln/detail/CVE-2026-123668
https://wpscan.com/vulnerability/62c1a6ac-0f9f-4402-b72b-8b10ffe6989c
https://github.com/advisories/GHSA-gph4-x2p9-rpr7