Description

The jet-form-builder-stripe-gateway WordPress plugin before 1.1.0 does not sanitise and escape a payment token before using it in a SQL statement, allowing unauthenticated users to extract arbitrary data from the database, including password hashes.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.6",
  "pubDate": "2026-09-23T06:16:59.060Z",
  "pubdate": "2026-09-23T06:16:59.060Z",
  "executiveSummary": "The JetFormBuilder Stripe Gateway plugin for WordPress, prior to version 1.1.0, contains a critical SQL injection vulnerability.\nThis flaw arises from improper sanitization and escaping of user-supplied payment token data before inclusion in database queries.\nSuccessful exploitation allows unauthenticated remote attackers to perform unauthorized SQL queries, leading to sensitive data exfiltration from the underlying database, including hashed user credentials.\nThe vulnerability represents a severe risk to WordPress environments as it bypasses authentication mechanisms, enabling full access to database content through blind or error-based SQL injection techniques.\nThe lack of input validation and parameterized queries serves as the primary vector, making the application susceptible to automated exploitation and data breaches.",
  "technicalDetails": "The vulnerability is classified as an unauthenticated SQL injection (SQLi) within the JetFormBuilder Stripe Gateway integration.\nRoot Cause: The plugin fails to apply adequate sanitization or structural validation to the 'payment token' parameter prior to integrating it into a dynamic SQL query string. This enables the direct injection of malicious SQL syntax into the database execution context.\nAffected Component: The module responsible for processing Stripe gateway payment confirmations lacks proper interface security controls for incoming request parameters. By failing to utilize prepared statements or appropriate escape functions (such as $wpdb->prepare), the plugin allows user-provided input to modify the logical structure of database queries.\nAttack Flow: An attacker initiates an HTTP request to the vulnerable endpoint, supplying a malicious string within the payment token field. Because the input is unsanitized, the application concatenates the attacker's payload directly into the SQL query executed by the database engine.\nPayload Behavior: Attackers typically utilize UNION-based SQL injection to append results from system tables or user meta tables to the query's output. By manipulating the 'WHERE' or 'SELECT' clauses, an adversary can bypass application logic and extract arbitrary records, specifically targeting the 'wp_users' table to acquire salted password hashes or administrative session tokens.\nExploitation Requirements: This vulnerability is reachable via the public web-facing interface. No prior authentication is required, meaning any remote user can trigger the flaw provided they can reach the target API endpoint. The attack vector is straightforward and does not require complex reconnaissance beyond identifying the specific vulnerable plugin version.\nImpact: The post-exploitation impact is critical. Beyond the theft of user password hashes, attackers may leverage the database access to gain remote administrative control over the WordPress installation, modify site content, or execute arbitrary code if the database configuration permits elevated privileges."
}