CVE-2026-12901

The GetPaid WordPress plugin prior to version 2.8.55 is vulnerable due to its failure to authenticate incoming Worldpay payment notifications, enabling attackers to falsely mark invoices as paid without actual transactions. This could lead to financial discrepancies and loss of revenue for businesses relying on the plugin for payment processing. WordPress site administrators using this plugin should prioritize updating to the latest version to mitigate potential exploitation.