An unauthenticated blind SQL injection flaw exists in the JetFormBuilder Stripe Gateway WordPress plugin before version 1.1.0. Unsanitised payment tokens are incorporated directly into a SQL query, allowing attackers to extract arbitrary data, including password hashes. The weakness corresponds to CWE‑89, reflecting SQL injection. The primary impact is the compromise of sensitive database contents, potentially exposing credentials and other confidential information, which could lead to account takeovers or further lateral movement.

Any installation of the JetFormBuilder Stripe Gateway WordPress plugin older than version 1.1.0 is affected. The vulnerability does not require special user privileges; it is triggered by unauthenticated access to the payment‑token handling endpoint.

The CVSS score of 8.6 classifies this flaw as High severity. EPSS is not available, so the exploitation probability is unknown, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is an unauthenticated HTTP request to the payment‑token endpoint where the token value is inserted into a SQL statement without escaping. Exploit requires no local privilege and could be performed remotely by any user. Due to the lack of a publicly known exploit and the high potential impact, the risk is considered significant in environments that rely on this plugin for payment processing.