What’s Vulnerable › Vulnerabilities
CVE-2022-4997: JetFormBuilder Stripe Gateway < 1.1.0 - Unauthenticated Blind SQLi via Payment Token
- Severity: high (CVSS 8.6 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.3% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2026-09-23 · updated 2026-09-23
- Weakness: CWE-89
Description
The jet-form-builder-stripe-gateway WordPress plugin before 1.1.0 does not sanitise and escape a payment token before using it in a SQL statement, allowing unauthenticated users to extract arbitrary data from the database, including password hashes.
Affected products
- jet-form-builder-stripe-gateway: before 1.1.0 — fixed in 1.1.0
How to fix
Upgrade to a fixed version: jet-form-builder-stripe-gateway 1.1.0. Check the vendor advisory for mitigations.
References
Get alerted when CVE-2022-4997 or the next vulnerability affects your stack