CVE-2026-17605

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-17605
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-17605.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-17605
Published
2026-08-01T07:49:51.153Z
Modified
2026-08-04T11:50:25.315525315Z
Severity
  • 6.6 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
Summary
Payment forms, Buy now buttons, and Invoicing System | GetPaid <= 2.8.56 - Authenticated (Administrator+) Local File Inclusion via Payment Form 'type' Element Field
Details

The Payment forms, Buy now buttons, and Invoicing System | GetPaid plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 2.8.56 via the getpaidpaymentform_element function. This makes it possible for authenticated attackers, with administrator-level access and above, to include and execute arbitrary .php files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where .php file types can be uploaded and included.

Database specific 
{
    "cwe_ids": [
        "CWE-98"
    ],
    "cna_assigner": "Wordfence",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/17xxx/CVE-2026-17605.json"
}
References

Affected packages

Git / github.com/ayecode/invoicing

Affected ranges

Type
GIT
Repo
https://github.com/ayecode/invoicing
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
02782c3af6acb86921987bfd8ab73392fbc75aca
Database specific 
{
    "source": "AFFECTED_FIELD",
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "last_affected": "2.8.56"
        }
    ]
}

Affected versions

0.*
0.0.2
0.0.3
0.0.4
1.*
1.0.1
1.0.10
1.0.11
1.0.12
1.0.13
1.0.14
1.0.15
1.0.15.1
1.0.16
1.0.17
1.0.18
1.0.2
1.0.3
1.0.4
1.0.5
1.0.6
1.0.7
1.0.8
1.0.9
2.*
2.0.0
2.0.1
2.0.2
2.0.3
2.0.5
2.0.6
2.0.7
2.0.8
2.1.0
2.1.1
2.1.10
2.1.2
2.1.3
2.1.4
2.1.5
2.1.6
2.1.7
2.1.8
2.1.9
2.2.0
2.2.1
2.2.2
2.2.3
2.2.4
2.2.5
2.2.6
2.3.0
2.3.1
2.3.2
2.3.3
2.3.4
2.3.5
2.3.6
2.4.0
2.4.1
2.4.2
2.4.3
2.4.4
2.4.5
2.4.6
2.4.7
2.4.8
2.5.0
2.5.1
2.5.10
2.5.11
2.5.12
2.5.13
2.5.14
2.5.2
2.5.3
2.5.4
2.5.5
2.5.6
2.5.7
2.5.8
2.5.9
2.6.0
2.6.1
2.6.10
2.6.11
2.6.12
2.6.13
2.6.14
2.6.15
2.6.16
2.6.17
2.6.18
2.6.19
2.6.2
2.6.20
2.6.21
2.6.22
2.6.23
2.6.24
2.6.25
2.6.26
2.6.3
2.6.4
2.6.6
2.6.7
2.6.8
2.6.9
2.7.0
2.7.1
2.7.2
2.7.3
2.7.4
2.7.5
2.7.6
2.7.7
2.7.8
2.7.9
2.8.0
2.8.1
2.8.10
2.8.11
2.8.12
2.8.13
2.8.14
2.8.15
2.8.16
2.8.17
2.8.18
2.8.19
2.8.2
2.8.20
2.8.21
2.8.22
2.8.23
2.8.24
2.8.25
2.8.26
2.8.27
2.8.28
2.8.29
2.8.3
2.8.30
2.8.31
2.8.32
2.8.33
2.8.34
2.8.35
2.8.36
2.8.38
2.8.39
2.8.4
2.8.40
2.8.41
2.8.42
2.8.43
2.8.44
2.8.45
2.8.46
2.8.47
2.8.48
2.8.49
2.8.5
2.8.50
2.8.51
2.8.52
2.8.53
2.8.54
2.8.55
2.8.56
2.8.6
2.8.7
2.8.8
2.8.9

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-17605.json"