The WP Full Stripe Free plugin for WordPress is vulnerable to SQL injection, which could allow an authenticated administrator to compromise the database.

The plugin fails to properly neutralize special elements used in SQL commands, resulting in a SQL injection vulnerability. This flaw requires the attacker to hold administrative privileges (PR:H) to trigger the malicious payload.

Successful exploitation of this SQL injection vulnerability could lead to unauthorized access to sensitive database information or disruption of service. Given the CVSS score of 7.6, this is a high-severity issue that poses a significant risk to the integrity and confidentiality of the WordPress environment.

Immediate Action: Update the WP Full Stripe Free plugin to version 8.3.0 or later, as provided by the vendor.

Proactive Monitoring: Review database query logs for anomalous or unauthorized SQL statements and monitor for unexpected administrative activity.

Compensating Controls: Deploy a Web Application Firewall (WAF) configured to inspect and block common SQL injection patterns targeting WordPress plugin endpoints.

Public Exploit Available: Yes, a public proof-of-concept exists on GitHub.

This vulnerability represents a high risk to WordPress installations utilizing the affected plugin. Administrators should prioritize updating the software to the latest version immediately to eliminate the injection flaw. If patching is not immediately feasible, ensure that administrative access is strictly controlled and monitor logs for any suspicious database interactions.