This vulnerability in WP Full Stripe Free plugin (versions <= 8.2.5) arises from improper neutralization of special elements in SQL commands, leading to SQL Injection. The CVSS 3.1 score is 7.6 (High), with an attack vector of network, low attack complexity, requiring high privileges, no user interaction, and a scope change. The impact affects confidentiality (high) and availability (low) but not integrity. No patch or vendor advisory is currently provided, and it is not a cloud service. Exploitation could allow an attacker with sufficient privileges to execute unauthorized SQL commands.

Successful exploitation could lead to unauthorized disclosure of sensitive database information (confidentiality impact) and partial disruption of service (availability impact). Integrity is not impacted per the CVSS vector. The attack requires high privileges, limiting the attacker profile to authenticated users with elevated rights. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict high-privilege access to the plugin and monitor for suspicious activity related to database queries. Avoid granting unnecessary privileges to users. Follow vendor updates closely for an official fix.