CVE-2026-17605: WordPress GetPaid Plugin RCE Vulnerability

CVE-2026-17605 Overview

CVE-2026-17605 is a Local File Inclusion (LFI) vulnerability in the Payment forms, Buy now buttons, and Invoicing System | GetPaid plugin for WordPress. The flaw affects all versions up to and including 2.8.56. It resides in the getpaid_payment_form_element function, which fails to restrict the element type value used to construct a file include path. Authenticated attackers with administrator-level access or above can include and execute arbitrary .php files on the server. The issue is categorized under CWE-98: Improper Control of Filename for Include/Require Statement in PHP Program.

Critical Impact
Attackers with administrator privileges can execute arbitrary PHP code, bypass access controls, and access sensitive data on affected WordPress installations.

Affected Products

GetPaid (Payment forms, Buy now buttons, and Invoicing System) WordPress plugin — all versions up to and including 2.8.56
Fixed in GetPaid version 2.8.57
WordPress sites using the AyeCode invoicing plugin distribution

Discovery Timeline

2026-08-01 - CVE-2026-17605 published to NVD
2026-08-03 - Last updated in NVD database

Technical Details for CVE-2026-17605

Vulnerability Analysis

The GetPaid plugin registers a set of payment form element types used to render individual form components. The rendering pipeline invokes getpaid_payment_form_element, which uses the element's type value to build a template path passed to a PHP include or require. Because the type parameter is not validated against an allow-list of registered element types, attackers can supply arbitrary values that traverse the filesystem and reach unintended .php files. When the resolved file is included, PHP executes its contents in the plugin's process context. This turns a template-render helper into an arbitrary PHP execution primitive whenever a writable or attacker-influenced .php file exists on disk.

Root Cause

The root cause is missing input validation on the payment form element type parameter used to construct a file inclusion path in includes/wpinv-template-functions.php. The affected code paths at lines 1432 and 1458 in versions 2.8.54 and 2.8.56 accept attacker-controlled element type strings without verifying they match a registered element. This corresponds to CWE-98, improper control of filename for include/require statements.

Attack Vector

Exploitation requires an authenticated session with administrator-level privileges or higher. An attacker submits a crafted payment form element definition where the type field references a path that resolves to a .php file already present on the server. When the element is rendered, the plugin executes the referenced PHP file. Combined with any file upload primitive that lands .php content on disk, this yields full remote code execution under the web server user.

php

 add_action( 'getpaid_invoice_line_items', 'getpaid_the_invoice_description', 100 );
 add_action( 'wpinv_email_billing_details', 'getpaid_the_invoice_description', 100 );
 
+/**
+ * Returns the list of registered payment form element types.
+ *
+ * @return string[] The list of registered payment form element types.
+ */
+function getpaid_get_payment_form_element_types() {
+    $types = wp_list_pluck( wpinv_get_data( 'payment-form-elements' ), 'type' );
+    return apply_filters( 'getpaid_payment_form_element_types', $types );
+}
+
 /**
  * Render element on a form.
  *

Source: GitHub Commit 80625ba. The patch introduces getpaid_get_payment_form_element_types(), which enumerates registered element types so the render function can reject unknown values before including any file.

Detection Methods for CVE-2026-17605

Indicators of Compromise

Requests to WordPress admin endpoints associated with GetPaid payment form editing that contain unusual type values referencing filesystem paths or .php extensions.
Unexpected PHP file creations under wp-content/uploads/ or plugin directories preceding payment form save actions.
Web server error logs showing include/require warnings referencing paths outside the plugin's template directory.
New or modified administrator accounts followed by GetPaid configuration changes.

Detection Strategies

Inspect payment form definitions stored in the database for element type values that do not match the built-in GetPaid element list.
Monitor wp-admin/admin.php and admin-ajax.php POST traffic for GetPaid actions containing path traversal sequences (../) or .php suffixes in element type parameters.
Correlate PHP process executions spawned by the web server user with prior authenticated GetPaid form save events.

Monitoring Recommendations

Enable WordPress audit logging for administrator actions, especially plugin configuration and payment form edits.
Alert on file writes of .php content anywhere under wp-content/uploads/ and on modifications to plugin files outside of controlled update windows.
Track anomalous administrator logins (new IPs, off-hours access) that precede GetPaid configuration changes.

How to Mitigate CVE-2026-17605

Immediate Actions Required

Upgrade the GetPaid plugin to version 2.8.57 or later on all WordPress sites.
Audit administrator accounts and remove or rotate credentials for any unrecognized or dormant admin users.
Review payment form definitions and remove any element entries whose type value does not correspond to a documented GetPaid element type.
Scan wp-content/ for unexpected .php files created since the plugin was installed and quarantine any suspicious artifacts.

Patch Information

The vendor released the fix in the AyeCode invoicing commit 80625ba, included in GetPaid 2.8.57. The patch adds getpaid_get_payment_form_element_types() and validates the incoming element type against this registered list before any template inclusion occurs. Additional details are available in the Wordfence Vulnerability Report.

Workarounds

Restrict administrator access using strong authentication and multi-factor authentication until the plugin is upgraded.
Deploy a web application firewall rule to block requests containing path traversal patterns or .php extensions in GetPaid payment form element parameters.
Disable the GetPaid plugin on affected sites where an immediate upgrade is not feasible.
Enforce PHP open_basedir restrictions to limit which directories the WordPress process can include files from.

bash

# Update the GetPaid plugin via WP-CLI to the patched release
wp plugin update invoicing --version=2.8.57

# Verify installed version
wp plugin get invoicing --field=version

# Locate unexpected PHP files under uploads that may be used for LFI-to-RCE chains
find wp-content/uploads -type f -name '*.php' -print