CVE-2026-17605 in Payment forms
Summary
by MITRE • 08/01/2026
The Payment forms, Buy now buttons, and Invoicing System | GetPaid plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 2.8.56 via the getpaid_payment_form_element function. This makes it possible for authenticated attackers, with administrator-level access and above, to include and execute arbitrary .php files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where .php file types can be uploaded and included.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 08/01/2026
The vulnerability identified in the GetPaid plugin for WordPress represents a critical local file inclusion flaw that has significant implications for WordPress site security. This weakness exists within the getpaid_payment_form_element function and affects all versions up to and including 2.8.56, creating a persistent risk across multiple plugin iterations. The vulnerability specifically targets authenticated attackers who possess administrator-level privileges or higher, making it particularly dangerous as it exploits legitimate administrative access rather than requiring initial exploitation through external vectors.
The technical nature of this flaw allows attackers with elevated privileges to manipulate the payment form element function and include arbitrary PHP files from the server filesystem. This capability enables remote code execution through the inclusion of malicious PHP code that has been uploaded or already exists on the target system. The vulnerability operates by accepting user-supplied input that is not properly validated or sanitized before being used in file inclusion operations, creating a direct path for attackers to bypass normal access controls and execute arbitrary commands with the privileges of the web server.
From an operational perspective, this vulnerability creates multiple attack vectors that can lead to complete system compromise. Attackers can leverage this flaw to bypass authentication mechanisms, extract sensitive data from the server, and establish persistent access through the execution of malicious PHP code. The impact extends beyond simple code execution as it allows for data exfiltration, privilege escalation, and potential lateral movement within compromised networks. When combined with other vulnerabilities or misconfigurations, this weakness can serve as a gateway for more extensive attacks.
Security practitioners should implement immediate mitigation strategies including restricting administrative privileges to only essential personnel, implementing robust input validation mechanisms, and applying the latest plugin updates from the vendor. The vulnerability aligns with CWE-22 (Improper Limitation of a Pathname to a Restricted Directory) and follows attack patterns consistent with those documented in the ATT&CK framework under T1059 (Command and Scripting Interpreter) and T1078 (Valid Accounts). Organizations should conduct thorough security assessments of their WordPress installations, review access controls, and implement monitoring solutions that can detect anomalous file inclusion activities. Additionally, maintaining up-to-date security patches and implementing network segmentation can help reduce the attack surface and limit potential damage from such vulnerabilities.