CVE-2022-4997: Jet Form Builder Stripe Gateway SQLI Flaw

CVE-2022-4997 Overview

CVE-2022-4997 is a SQL injection vulnerability [CWE-89] in the JetFormBuilder Stripe Gateway WordPress plugin. Versions prior to 1.1.0 fail to sanitize and escape a payment token parameter before including it in a SQL statement. Unauthenticated attackers can inject arbitrary SQL through the payment token, enabling extraction of sensitive data from the WordPress database. Extractable data includes user password hashes, which attackers can crack offline for account takeover.

Critical Impact
Unauthenticated attackers can exfiltrate arbitrary database contents, including WordPress user password hashes, through a crafted payment token parameter.

Affected Products

JetFormBuilder Stripe Gateway WordPress plugin versions prior to 1.1.0
WordPress sites processing payments through the affected plugin
Any deployment exposing the vulnerable payment token endpoint to the internet

Discovery Timeline

2026-09-23 - CVE-2022-4997 published to NVD
2026-09-23 - Last updated in NVD database

Technical Details for CVE-2022-4997

Vulnerability Analysis

The vulnerability resides in the payment token handling logic of the JetFormBuilder Stripe Gateway plugin. The plugin accepts a payment token value from an HTTP request and concatenates it directly into a SQL query. No parameterized query, prepared statement, or escaping routine such as wpdb::prepare() guards the input path.

An unauthenticated attacker can supply crafted SQL fragments inside the payment token parameter. The database executes the injected clauses as part of the original query. This exposes any data the WordPress database user can read, including the wp_users table and its user_pass column of hashed credentials.

Exploitation requires no authentication and no user interaction. The attack traverses the network, and successful extraction of password hashes enables subsequent credential cracking and lateral movement into administrator accounts.

Root Cause

The root cause is missing input sanitization on the payment token field before it reaches the SQL layer. WordPress provides wpdb::prepare() and esc_sql() helpers for exactly this purpose. The affected plugin bypasses both, treating attacker-controlled input as trusted SQL syntax.

Attack Vector

The attack vector is network-based over HTTPS to the WordPress site processing payments. An attacker submits a request to the vulnerable payment processing endpoint with a malicious payment token value. The token payload contains SQL syntax such as UNION SELECT clauses that extract data from adjacent tables. Refer to the WPScan Vulnerability Report for the technical write-up.

Detection Methods for CVE-2022-4997

Indicators of Compromise

HTTP requests to JetFormBuilder Stripe payment endpoints containing SQL keywords such as UNION, SELECT, SLEEP(, or information_schema
Anomalous outbound queries from the WordPress database process reading wp_users or wp_usermeta tables outside normal application flow
Web server access logs showing unusually long payment token parameter values or URL-encoded SQL syntax
Unexpected administrator logins following payment endpoint traffic spikes

Detection Strategies

Deploy web application firewall rules that inspect payment token parameters for SQL metacharacters and common injection payloads
Enable MySQL general query logging on staging or high-risk sites to identify malformed queries originating from the plugin
Correlate WordPress access logs with database error logs to surface failed injection attempts that return SQL syntax errors

Monitoring Recommendations

Alert on repeated 500-series responses from /wp-json/ or admin-ajax endpoints tied to JetFormBuilder
Monitor for outbound data transfers from the WordPress host that deviate from baseline volumes
Track successful logins for privileged accounts against source IPs previously seen probing payment endpoints

How to Mitigate CVE-2022-4997

Immediate Actions Required

Upgrade the JetFormBuilder Stripe Gateway plugin to version 1.1.0 or later on every affected WordPress site
Rotate all WordPress user passwords, especially administrator accounts, assuming hash disclosure until proven otherwise
Rotate Stripe API keys and any secrets stored in the WordPress database that the plugin could access
Audit the wp_users table for unexpected accounts and review recent administrative actions in audit logs

Patch Information

The plugin vendor addressed the SQL injection in version 1.1.0 by sanitizing the payment token before it reaches the SQL statement. Site administrators should update through the WordPress plugin dashboard or via WP-CLI using wp plugin update jet-form-builder-stripe-gateway. Confirm the installed version matches or exceeds 1.1.0 after the update.

Workarounds

Deactivate and remove the JetFormBuilder Stripe Gateway plugin until the update is applied
Restrict access to payment endpoints behind a web application firewall with SQL injection signatures enabled
Apply least-privilege database credentials so the WordPress database user cannot read unrelated tables or execute administrative statements

bash

# Update the vulnerable plugin using WP-CLI
wp plugin update jet-form-builder-stripe-gateway --version=1.1.0
wp plugin list --name=jet-form-builder-stripe-gateway --fields=name,status,version