Payment Forms Buy Now Buttons And Invoicing System Getpaid
Monthly
Local file inclusion in the GetPaid WordPress plugin (versions ≤ 2.8.56) enables authenticated administrators to include and execute arbitrary PHP files on the server by supplying a crafted element type value to the getpaid_payment_form_element function. The root cause (CWE-98) is twofold: the element type string was used unsanitized to construct a PHP template file path, and the bare extract($element) call without EXTR_SKIP allowed attacker-controlled array keys to overwrite internal variables including the path already resolved. No public exploit code or active exploitation (CISA KEV listing) has been identified at time of analysis; real-world risk is substantially constrained by the administrator-level access and PHP file upload prerequisites.
Local file inclusion in the GetPaid WordPress plugin (versions ≤ 2.8.56) enables authenticated administrators to include and execute arbitrary PHP files on the server by supplying a crafted element type value to the getpaid_payment_form_element function. The root cause (CWE-98) is twofold: the element type string was used unsanitized to construct a PHP template file path, and the bare extract($element) call without EXTR_SKIP allowed attacker-controlled array keys to overwrite internal variables including the path already resolved. No public exploit code or active exploitation (CISA KEV listing) has been identified at time of analysis; real-world risk is substantially constrained by the administrator-level access and PHP file upload prerequisites.