CVE-2026-17605 is a Local File Inclusion vulnerability (CWE-98) in the stiofansisland Payment forms, Buy now buttons, and Invoicing System | GetPaid WordPress plugin. The flaw exists in the getpaid_payment_form_element function and affects all versions up to and including 2.8.56. Authenticated attackers with administrator privileges can exploit this vulnerability to include arbitrary PHP files on the server, enabling execution of arbitrary PHP code. This can result in unauthorized access, data exposure, or full code execution on the affected server.

An attacker with administrator-level access can exploit this vulnerability to execute arbitrary PHP code on the server by including malicious PHP files. This can lead to bypassing access controls, unauthorized data access, and potentially full system compromise. The CVSS 3.1 base score is 6.6 (medium severity), reflecting network attack vector, high privileges required, no user interaction, and high impact on confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict administrator access to trusted users only and monitor for suspicious activity related to file inclusion. Avoid uploading untrusted PHP files to the server. Follow the vendor's updates for any released patches or official mitigations.