CVE-2026-17605 stiofansisland CVE debrief

Who should care

Administrators and above of WordPress installations using the GetPaid plugin, as well as security teams and vulnerability management teams responsible for reviewing and mitigating vulnerabilities in their environments, should be aware of this vulnerability and take necessary actions to protect their systems. This includes reviewing and restricting access to sensitive files and functions, monitoring for suspicious activity, and updating to the latest version of the GetPaid plugin. Additionally, operators and platform administrators should assess their exposure and implement compensating controls if necessary.

Technical summary

The Payment forms, Buy now buttons, and Invoicing System | GetPaid plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 2.8.56 via the getpaid_payment_form_element function. This vulnerability allows authenticated attackers with administrator-level access to include and execute arbitrary .php files, potentially leading to code execution, sensitive data access, or bypassing access controls.

Defensive priority

Authenticated administrators and above should review and restrict access to sensitive files and functions.

Recommended defensive actions

• Restrict access to sensitive files and functions
• Monitor for suspicious activity
• Update to the latest version of the GetPaid plugin
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.

Evidence notes

The vulnerability was reported by [email protected] and is related to the getpaid_payment_form_element function in the GetPaid plugin for WordPress. The plugin is vulnerable to Local File Inclusion in all versions up to, and including, 2.8.56. This makes it possible for authenticated attackers, with administrator-level access and above, to include and execute arbitrary .php files on the server, allowing the execution of any PHP code in those files. Evidence is limited to the supplied CVE record and NVD detail. Defenders should verify affected product deployments, review official advisories, and plan vendor-supported updates or mitigations.

Official resources