Security Alert Summary
The Payment forms, Buy now buttons, and Invoicing System | GetPaid plugin for WordPress contains a local file inclusion vulnerability in the getpaid_payment_form_element function. Authenticated users with administrator-level privileges or higher can include and execute arbitrary .php files on the server, which may allow execution of arbitrary PHP code, bypassing access controls or exposing sensitive data when .php file types can be uploaded and included.
CVE Details
- CVE ID: CVE-2026-17605
- Affected component: Payment forms, Buy now buttons, and Invoicing System | GetPaid plugin for WordPress
- Affected versions: All versions up to and including 2.8.56
- Published: August 1, 2026 at 9:17:01 AM
- Last modified: August 1, 2026 at 9:17:01 AM
- CVSS v3.1: Base Score 6.6, Severity MEDIUM
- Vector String: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H
- Authentication: Required (attacker must be an authenticated user)
- Privileges required: High (administrator-level access and above)
- User interaction: None
- Primary impact: Confidentiality: High; Integrity: High; Availability: High
- CWE / weakness: CWE-98 (Improper Control of Filename for Include/Require Statement)
Technical Details
The vulnerability is a local file inclusion in the getpaid_payment_form_element function. Due to insufficient validation or sanitization of file paths passed to inclusion routines, an authenticated attacker with administrator-level privileges can cause the plugin to include arbitrary .php files from the server. When an included file contains PHP code, that code will execute with the web server’s PHP interpreter.
Named function involved: getpaid_payment_form_element. The CVE description indicates the vulnerability permits inclusion and execution of arbitrary PHP files, which can be used to bypass access controls, obtain sensitive data, or achieve code execution in scenarios where .php files can be uploaded and included.
How This Could Impact Your Website
Consider a WordPress installation with multiple users: a site owner, internal staff who manage content, and an external contractor who uploads media or templates. If an administrator account or another high-privilege account is compromised or misused, an attacker could leverage this vulnerability to include a crafted .php file and execute arbitrary code on the server.
Practical consequences include exposure of internal user email addresses or other stored data, and an increased risk of targeted phishing or social engineering based on harvested information. The vulnerability does not imply automatic full site takeover in all cases, but it materially raises the risk of data exposure and unauthorized actions when exploited.
If you
re unsure whether your site is affected or how to assess your current user roles and plugins, it may be worth having a professional review your setup.
Recommended Actions
- Update the affected plugin as soon as a patched version is available.
- Review and reduce unnecessary user roles, especially accounts with administrator-level or equivalent privileges.
- Enforce strong passwords and enable two-factor authentication for editors and administrators.
- Remove unused or unmaintained plugins and themes from your site.
- Monitor site activity and logs for unusual behavior, especially file uploads and inclusion attempts.
If you
like help reviewing your plugins, user roles, or overall WordPress security posture, our team at Freshy is happy to help.
References
- https://github.com/AyeCode/invoicing/commit/80625ba90241840e46b0bc5400f100e6d38ee85c
- https://plugins.trac.wordpress.org/browser/invoicing/tags/2.8.54/includes/admin/class-getpaid-metaboxes.php#L257
- https://plugins.trac.wordpress.org/browser/invoicing/tags/2.8.54/includes/admin/meta-boxes/class-getpaid-meta-box-payment-form.php#L131
- https://plugins.trac.wordpress.org/browser/invoicing/tags/2.8.54/includes/wpinv-template-functions.php#L1432
- https://plugins.trac.wordpress.org/browser/invoicing/tags/2.8.54/includes/wpinv-template-functions.php#L1458
- https://plugins.trac.wordpress.org/browser/invoicing/tags/2.8.56/includes/admin/class-getpaid-metaboxes.php#L257
- https://plugins.trac.wordpress.org/browser/invoicing/tags/2.8.56/includes/admin/meta-boxes/class-getpaid-meta-box-payment-form.php#L131
- https://plugins.trac.wordpress.org/browser/invoicing/tags/2.8.56/includes/wpinv-template-functions.php#L1432
- https://plugins.trac.wordpress.org/browser/invoicing/tags/2.8.56/includes/wpinv-template-functions.php#L1458
- https://www.wordfence.com/threat-intel/vulnerabilities/id/baca279b-0c42-48a9-930a-8d0525066e0a?source=cve
