The Stripe Payment Plugin for WooCommerce contains an SQL Injection vulnerability (CWE-89) due to insufficient escaping and lack of proper query preparation on the user-supplied 'id' parameter. This flaw allows unauthenticated attackers to append arbitrary SQL commands to existing queries, enabling extraction of sensitive data from the database. The vulnerability affects all plugin versions up to 3.7.9 and has a CVSS 3.1 base score of 9.8, indicating critical severity with network attack vector, no privileges required, and impacts on confidentiality, integrity, and availability.

Successful exploitation of this vulnerability can lead to unauthorized disclosure of sensitive information stored in the database, modification or deletion of data, and potential disruption of service. Because the attack requires no authentication and can be performed remotely, the risk to affected installations is high.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider disabling or restricting access to the vulnerable plugin component to prevent exploitation. Monitor the vendor's channels for updates and apply patches promptly once available.