This vulnerability (CVE-2025-22652) in kendysond Payment Forms for Paystack arises from improper neutralization of special elements used in SQL commands, leading to SQL Injection. It affects all versions up to and including 4.0.1. The CVSS 3.1 base score is 7.6, indicating high severity, with an attack vector over the network, low attack complexity, requiring high privileges, no user interaction, and a scope change. The impact includes high confidentiality impact and low availability impact, with no integrity impact. No patch or vendor advisory is currently provided, and no exploits are known in the wild.

Successful exploitation could allow an attacker with high privileges to execute unauthorized SQL commands, potentially leading to disclosure of sensitive information (high confidentiality impact) and partial disruption of service (low availability impact). Integrity is not impacted according to the CVSS vector. Since no known exploits are reported, the risk is theoretical but significant given the nature of SQL Injection vulnerabilities.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the affected application to trusted users only, and monitor for unusual database activity. Avoid exposing the vulnerable versions to untrusted networks. Do not rely on generic mitigations; await vendor-provided patches or official guidance.