The GetPaid plugin is susceptible to a local file inclusion flaw triggered through the getpaid_payment_form_element function. An authenticated user with administrator privilege can supply a crafted type value that causes the plugin to include an arbitrary PHP file located on the server. This allows the attacker to execute any PHP code contained in that file, effectively bypassing access controls, retrieving sensitive data, or performing arbitrary code execution. The underlying weakness is a CWE‑98 Local File Inclusion.

The vulnerability affects the stiofansisland Payment forms, Buy now buttons, and Invoicing System | GetPaid plugin for WordPress. All versions up to and including 2.8.56 are impacted. No later releases are listed as affected.

The CVSS score of 6.6 indicates moderate severity, while the EPSS score of < 1% signals a low probability of exploitation in the wild. The vulnerability is not listed in CISA’s KEV catalog. Exploitation requires administrator-level access to the WordPress admin interface. Once an attacker supplies a malicious value for the type field, the plugin will include the targeted file; if the attacker can also upload arbitrary PHP files, the impact escalates to full code execution. These conditions constrain the threat vector to privileged users, but consequence for the entire site could be severe.