The Stripe Payment Forms by WP Full Pay – Accept Credit Card Payments, Donations & Subscriptions WordPress plugin is vulnerable to SQL Injection via the 'wpfs-form-name' parameter due to insufficient escaping and lack of proper SQL query preparation. This allows unauthenticated attackers to append malicious SQL queries to existing ones, potentially extracting sensitive data from the database. The vulnerability affects all plugin versions up to and including 8.3.1. The CVSS 3.1 base score is 7.5 (High), reflecting network attack vector, low attack complexity, no privileges required, no user interaction, unchanged scope, high confidentiality impact, and no integrity or availability impact. No patch or vendor advisory is provided in the data.

Successful exploitation allows unauthenticated attackers to perform SQL Injection attacks, potentially extracting sensitive information from the backend database. The confidentiality of data is impacted, but integrity and availability are not affected. No known exploits in the wild have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, consider restricting access to the vulnerable plugin functionality or disabling the plugin to prevent exploitation. Monitor for vendor updates regarding patches or mitigations.