CVE-2025-9322
BaseFortify
Publication date: 2025-10-25
Last updated on: 2025-10-27
Assigner: Wordfence
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| wp_full_pay | wp_full_stripe_free | 8.3.2 |
| wp_full_pay | wp_full_stripe_free | 8.3.1 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-89 | The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability is an SQL Injection in the Stripe Payment Forms by WP Full Pay WordPress plugin (versions up to and including 8.3.1). It occurs because the plugin does not properly escape or prepare the 'wpfs-form-name' parameter before including it in SQL queries. This allows unauthenticated attackers to inject malicious SQL code into database queries, potentially extracting sensitive information. [1]
How can this vulnerability impact me? :
The vulnerability can allow attackers to extract sensitive information from the database without authentication by injecting malicious SQL queries. This can lead to data exposure, including payment forms, donations, subscriptions, and other sensitive user data stored by the plugin. [1]
How can this vulnerability be detected on my network or system? Can you suggest some commands?
You can detect this vulnerability by checking the version of the 'wp-full-stripe-free' WordPress plugin installed on your system. Versions up to and including 8.3.1 are vulnerable. There are no specific network or system commands provided in the resources to detect exploitation attempts. However, reviewing your WordPress plugin versions via WP-CLI can help: `wp plugin list` to check the installed version of 'wp-full-stripe-free'. Additionally, monitoring database logs for suspicious SQL queries involving the 'wpfs-form-name' parameter might help detect exploitation attempts. [1]
What immediate steps should I take to mitigate this vulnerability?
The immediate mitigation step is to update the 'wp-full-stripe-free' WordPress plugin to version 8.3.2 or later, where the SQL injection vulnerabilities have been fixed by refactoring all unsafe SQL queries to use prepared statements and proper parameter binding. This update prevents unauthenticated attackers from exploiting the 'wpfs-form-name' parameter to perform SQL injection. [1]