What the vulnerability does
01Description
The Payment forms, Buy now buttons, and Invoicing System | GetPaid plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 2.8.56 via the getpaid_payment_form_element function. This makes it possible for authenticated attackers, with administrator-level access and above, to include and execute arbitrary .php files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where .php file types can be uploaded and included.
Explanation of Vulnerability in Simple Terms
02Summary
GetPaid versions up to 2.8.56 contain a PHP remote file inclusion vulnerability that allows high-privileged attackers to include and execute arbitrary PHP files from remote servers. The vulnerability requires administrator-level access and high attack complexity. Successful exploitation grants full control over site data and functionality.
What an attacker can do
03Attacker Capabilities
Include and execute arbitrary PHP code from remote servers, gaining full control over the site.
Potential impact on your site
04Site Impact
An admin account compromise could allow an attacker to run malicious code and take over your entire site.
Conditions required to exploit
05Prerequisites
Attacker must have administrator-level access to the site and exploit requires specific technical conditions.
Key dates
06Disclosure timeline
August 1, 2026
CVE published
August 3, 2026
Record updated
