Introduction
CVE-2025-9322 is a critical flaw in a popular WordPress payment plugin, and attackers can use it to remotely extract sensitive information from WordPress databases. The affected plugin, Stripe Payment Forms by WP Full Pay, is widely deployed to handle credit card payments, donations, and subscriptions on WordPress sites. The vulnerability allows unauthenticated SQL injection through a user-supplied parameter, which puts thousands of sites at risk until they are patched.
About WP Full Pay and Themeisle: WP Full Pay is a Stripe-verified payment solution for WordPress and is now part of the Themeisle family. Themeisle is a major WordPress vendor with millions of users and a broad portfolio of plugins and themes, so a flaw in one of its products has a particularly wide reach across WordPress.
Technical Information
CVE-2025-9322 is an unauthenticated SQL injection vulnerability in the Stripe Payment Forms by WP Full Pay plugin for WordPress. The flaw exists in all versions up to and including 8.3.1. It comes from insufficient escaping and the lack of prepared statements for the 'wpfs-form-name' parameter. When a request includes this parameter, the plugin places its value directly into an SQL query without adequate sanitization. An attacker can then append arbitrary SQL, and the database executes it with the plugin's privileges.
The root cause is improper input handling. The plugin does not properly escape or parameterize user data before it uses that data in SQL queries. This is a classic SQL injection, and it lets attackers manipulate queries and potentially retrieve sensitive information from the WordPress database, such as user data or payment records. The attack works remotely and needs no authentication, which raises its risk. No public code snippets or proof of concept are available for this vulnerability.
Affected Systems and Versions
- Product: Stripe Payment Forms by WP Full Pay plugin for WordPress
- Affected versions: All versions up to and including 8.3.1
- Vulnerable parameter: 'wpfs-form-name'
- No specific configuration is required for exploitation beyond running a vulnerable plugin version
Vendor Security History
Public sources show no chronic pattern of SQL injection issues in WP Full Pay, which is now under Themeisle. The plugin is Stripe-verified and has a large user base. The vendor released a patch for this vulnerability after public disclosure. Themeisle's involvement indicates a mature support and security process.
