CVE-2026-12901

CVE-2026-12901 is a signature verification bypass in GetPaid's Worldpay integration. The plugin accepts payment notification callbacks without validating that they actually came from Worldpay—any unauthenticated HTTP request with the right invoice ID and status parameters flips the invoice to paid. This isn't a minor configuration oversight; it's the complete abandonment of the cryptographic contract that makes server-to-server payment notifications trustworthy. The CVSS 5.9 score badly misrepresents this. The real problem isn't the single forged notification—it's the downstream contamination. GetPaid invoices feed fulfillment systems, accounting software, and CRM records. When an attacker marks an invoice paid via forged callback, shipment logic releases goods, accounts receivable closes the ticket, and accounting software records revenue that never existed. You get chargeback liability, not just reconciliation headaches. Exploitation is trivial. If invoice IDs are sequential (common in WordPress where post IDs increment), an attacker can enumerate them and flip entire merchant portfolios to paid in seconds. Even with UUIDs, the attack surface is wider than you'd think—UUID generation in plugins is often predictable. Before you assume you're safe: verify your GetPaid version includes the patch, confirm Worldpay callbacks are hitting an endpoint that performs HMAC validation (check the plugin code for hash_hmac or equivalent), and audit whether old Worldpay integrations are still active in your codebase. If you're on an unpatched version, treat this as business-critical, not medium-severity. The CVSS score reflects the vulnerability in isolation, not the system it poisons.

Reviewed through automated stages and approved by a human before publication.