CVE-2026-17605 is a Local File Inclusion vulnerability (CWE-98) in the Payment forms, Buy now buttons, and Invoicing System | GetPaid WordPress plugin. The flaw exists in the getpaid_payment_form_element function, which improperly controls the filename used in include/require statements. Authenticated attackers with administrator privileges can exploit this to include arbitrary PHP files on the server, enabling execution of arbitrary PHP code. This can result in access control bypass, sensitive data disclosure, or remote code execution. The vulnerability affects all plugin versions up to and including 2.8.56. No official patch or remediation guidance is currently documented.

An attacker with administrator-level access can exploit this vulnerability to execute arbitrary PHP code on the server by including malicious PHP files. This can lead to full compromise of the affected system, including bypassing access controls and unauthorized data access. The impact is high confidentiality, integrity, and availability risk due to potential remote code execution.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict administrator access to trusted users only and monitor for suspicious activity related to file inclusion. Avoid uploading PHP files or other executable content through the plugin. Follow vendor updates closely for an official fix.