Junglewise Threat Intelligence

CVE-2026-17605: AyeCode GetPaid Local File Inclusion in getpaid_payment_form_element

CVE-2026-17605 · Severity: medium · CVSS 6.6 · Published 2026-08-01

Executive brief

The GetPaid plugin for WordPress, which handles payment forms and invoicing, contains a security flaw that could allow an administrator to execute unauthorized code on the server. By exploiting this vulnerability, a high-privileged user could potentially access sensitive data or take full control of the website's underlying server. This risk is particularly high if the attacker is able to upload malicious files to the system.

Technical details

A Local File Inclusion (LFI) vulnerability exists in the GetPaid plugin for WordPress due to insufficient validation of the element type in the 'getpaid_payment_form_element' function. Authenticated attackers with administrator-level privileges can exploit this to include and execute arbitrary .php files on the server. The vulnerability stems from the plugin failing to validate element types against an allowlist before processing them in template functions. If an attacker can upload a .php file through other means, this LFI can be escalated to full Remote Code Execution (RCE). A fix has been identified in the plugin's source code that implements an allowlist and uses the EXTR_SKIP flag to prevent variable clobbering.

Affected products

  • AyeCode Payment forms, Buy now buttons, and Invoicing System | GetPaid All versions up to, and including, 2.8.56

Timeline

  • 2026-08-01: advisory: NVD publication date
  • 2026-08-01: patched: Fix committed to GitHub repository

References