The plugin "Stripe Payment Forms by WP Full Pay – Accept Credit Card Payments, Donations & Subscriptions" is vulnerable to unauthenticated SQL injection through the 'wpfs-form-name' parameter. The lack of escaping and insufficient use of prepared statements allow an attacker to append arbitrary SQL to existing queries, potentially extracting sensitive data from the database. This flaw is classified as CWE‑89.

WordPress sites using the Themeisle Stripe Payment Forms plugin up to and including version 8.3.1 are affected. The vulnerability applies to all forms that accept the 'wpfs-form-name' field.

The CVSS score of 7.5 indicates a high severity vulnerability. The EPSS score of less than 1% suggests a low likelihood of exploitation today, and the issue is not listed in CISA KEV. Attackers can exploit this flaw without authentication by submitting crafted requests to the plugin’s forms, which are typically accessible to all site visitors. The potential impact is the disclosure of database contents, including payment information.