Security Alert Summary
The jet-form-builder-stripe-gateway WordPress plugin before 1.1.0 fails to sanitise and escape a payment token before including it in a SQL statement. This allows unauthenticated attackers to perform SQL injection and extract arbitrary data from the database, including password hashes.
CVE Details
- CVE ID: CVE-2022-4997
- Affected component: jet-form-builder-stripe-gateway WordPress plugin
- Affected versions: Versions before 1.1.0 (less than 1.1.0)
- Published: September 23, 2026 at 6:16:59 AM
- Last modified: September 23, 2026 at 11:17:08 AM
- CVSS v3.1: Base score 8.6, Severity: HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N - Authentication / Privileges / User interaction:
- Privileges required: None
- Authentication required: None (unauthenticated)
- User interaction: None
- Attack vector: Network
- Attack complexity: Low
- Scope: Changed
- Primary impact:
- Confidentiality: High
- Integrity: None
- Availability: None
- Weakness (CWE): CWE-89 (SQL Injection)
Technical Details
The plugin does not sanitise and escape a payment token before using it in a SQL statement. This creates an SQL injection vulnerability: an attacker can supply a crafted payment token that alters the SQL query logic and causes the database to return arbitrary data.
The description indicates the unsanitised token is incorporated directly into a SQL statement. Because the vulnerability is reachable without authentication and requires no user interaction, an attacker can query the database remotely to extract data, including sensitive fields such as password hashes. No specific function names or REST endpoints are provided in the available data.
Impact is limited to data disclosure via SQL injection; the CVSS metrics indicate confidentiality impact is high while integrity and availability impacts are not indicated.
How This Could Impact Your Website
Consider a small WordPress site that uses the plugin to accept payments. A site owner and internal staff (editors or administrators) manage content and user accounts, while an external contractor or contributor may submit forms or payment-related data. Because the vulnerability allows unauthenticated extraction of database contents, an attacker could retrieve user records stored in the database.
- Internal user email addresses and other contact information could be exposed, increasing the risk of targeted phishing against staff and contractors.
- Password hashes could be obtained and potentially cracked offline, raising the chance of credential reuse leading to account takeover elsewhere.
- Even without direct site takeover, disclosure of user data can lead to business disruption, trust loss, and increased support burden.
If youre unsure whether your site is affected or how to assess your current user roles and plugins, it may be worth having a professional review.
Recommended Actions
- Update the affected plugin as soon as a patched version is available.
- Review and reduce unnecessary user roles, especially contributor and editor privileges.
- Enforce strong passwords and enable two-factor authentication for editors and administrators.
- Remove unused or unmaintained plugins from your site.
- Monitor site activity and database access for unusual behavior or unexpected queries.
If youd like help reviewing your plugins, user roles, or overall WordPress security posture, our team at Freshy is happy to help.
