A critical SQL injection vulnerability in the JetFormBuilder Stripe Gateway plugin allows unauthenticated attackers to compromise sensitive database contents.

This is a SQL injection (CWE-89) vulnerability occurring because the plugin fails to sanitize or escape the payment token parameter before including it in database queries. This flaw permits unauthenticated remote users to execute arbitrary SQL commands against the database.

The ability for an unauthenticated user to perform SQL injection poses a severe risk to organizational data integrity and confidentiality. Attackers could extract sensitive information, including administrative password hashes and user data, potentially leading to a complete compromise of the WordPress installation and associated services. The CVSS score of 8.6 reflects the high severity of this remote, unauthenticated access vector.

Immediate Action: Update the jet-form-builder-stripe-gateway plugin to version 1.1.0 or later immediately.

Proactive Monitoring: Review database query logs for unusual patterns or unexpected error messages that may indicate automated SQL injection attempts.

Compensating Controls: Deploy a Web Application Firewall (WAF) with updated rulesets to detect and block malicious SQL injection payloads targeting the payment token parameter.

Public Exploit Available: No

Given the high CVSS score and the potential for full database exfiltration, this vulnerability represents a significant security risk. Administrators should prioritize updating the plugin to version 1.1.0 immediately to eliminate the injection vector. If updating is not possible, consider disabling the plugin until a patch can be applied to prevent unauthorized data exposure.