PT-2026-97154 · WordPress · Jet-Form-Builder-Stripe-Gateway

Jakub Herman

·

CVE-2022-4997

·

Published

2026-09-23

·

Updated

2026-09-23

CVSS v3.1

8.6

High

VectorAV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
Name of the Vulnerable Software and Affected Versions jet-form-builder-stripe-gateway WordPress plugin versions prior to 1.1.0
Description An issue exists where a payment token is not properly sanitized or escaped before being used in a SQL statement. This allows unauthenticated users to perform SQL injection to extract arbitrary data from the database, such as password hashes.
Recommendations Update jet-form-builder-stripe-gateway WordPress plugin to version 1.1.0 or later.

Exploit

Fix

SQL injection

Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2022-4997

Affected Products

Jet-Form-Builder-Stripe-Gateway