CVE WATCH / VULNERABILITY DETAIL
CVE-2026-119747
HIGHCVSS 7.1NVD feed
Published 4 November 2026 · tracked since 5 November 2026
Description
The GetPaid plugin for WordPress before 2.8.63 contains an incorrect authorization vulnerability where the check_post_permissions() method in includes/api/class-getpaid-rest-posts-controller.php maps REST operations to generic WordPress post capabilities instead of enforcing the plugin's manage_invo
References
- NVD — National Vulnerability Database
- CVE.org record (MITRE)
- CISA Known Exploited Vulnerabilities catalog
Latest tracked vulnerabilities
- CVE-2026-54372 HIGH 8.8
- CVE-2026-121751 LOW 3.1
- CVE-2026-121746 MEDIUM 5.5
- CVE-2026-121747 MEDIUM 5.5
- CVE-2026-121748 LOW 3.6
- CVE-2026-121749 LOW 3.3
- CVE-2026-121750 LOW 3.1
- CVE-2026-121745 LOW 2.5
- CVE-2026-103002 HIGH 8.8
- CVE-2026-102280