CVE-2022-4997

Summary

The flaw allows unauthenticated users to extract arbitrary data, including password hashes, by injecting a payment token into a SQL statement without proper sanitization.

Exploitability

Exploitation is relatively easy given the lack of authentication required, and the specific payment token can be crafted to extract sensitive data.

Blast radius

If exploited, the impact could be severe, as it allows unauthorized access to sensitive database information, potentially leading to data breaches.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to version 1.1.0 or later of the jet-form-builder-stripe-gateway WordPress plugin.

Analysis generated locally by qwen2.5:7b-instruct (no data left the box). AI-assisted — verify against primary sources before acting.