{"id":"CVE-2026-100144","aliases":["EUVD-2026-117349","GHSA-8q9v-ph95-jh42"],"status":"published","title":"IVPAY payments \u003c= 1.0.8 - Unauthenticated SQLi via 'payment_id' Parameter","description":"The IVPAY payments WordPress plugin through 1.0.8 does not sanitise a value from its payment callback before using it in a SQL statement, and treats an empty API key, which is its own default, as valid authentication, allowing unauthenticated attackers to read arbitrary data from the database.","severity":{"version":"3.1","score":9.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N","level":"critical","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-14","score":0.00256,"percentile":0.17377,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-89"],"published":"2026-11-05T06:00:28Z","modified":"2026-11-06T12:08:30Z","products":[{"vendor":"unknown","product":"ivpay payments"}],"references":[{"url":"https://wpscan.com/vulnerability/d90db791-2223-480b-8d2f-b84170318fc4/","tags":["exploit","vdb-entry","technical-description"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-100144"},{"url":"https://wpscan.com/vulnerability/d90db791-2223-480b-8d2f-b84170318fc4"},{"url":"https://github.com/advisories/GHSA-8q9v-ph95-jh42"}],"sources":{"cve":[{"id":"CVE-2026-100144","title":"IVPAY payments \u003c= 1.0.8 - Unauthenticated SQLi via 'payment_id' Parameter","description":"The IVPAY payments WordPress plugin through 1.0.8 does not sanitise a value from its payment callback before using it in a SQL statement, and treats an empty API key, which is its own default, as valid authentication, allowing unauthenticated attackers to read arbitrary data from the database.","status":"published","published":"2026-11-05T06:00:28.484Z","modified":"2026-11-06T12:08:30.452Z","cvss":[{"version":"3.1","score":9.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N","level":"critical","assessor":"adp"}],"cwes":["CWE-89"],"updated_at":"2026-11-06T13:28:12.24582Z"}],"euvd":[{"id":"EUVD-2026-117349","description":"The IVPAY payments WordPress plugin through 1.0.8 does not sanitise a value from its payment callback before using it in a SQL statement, and treats an empty API key, which is its own default, as valid authentication, allowing unauthenticated attackers to read arbitrary data from the database.","status":"published","published":"2026-11-05T06:00:28Z","modified":"2026-11-06T12:08:30Z","cvss":[{"version":"3.1","score":9.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N","level":"critical"}],"updated_at":"2026-11-06T13:04:55.758116Z"}],"ghsa":[{"id":"GHSA-8q9v-ph95-jh42","title":"The IVPAY payments WordPress plugin through 1.0.8 does not sanitise a value from its payment...","description":"The IVPAY payments WordPress plugin through 1.0.8 does not sanitise a value from its payment callback before using it in a SQL statement, and treats an empty API key, which is its own default, as valid authentication, allowing unauthenticated attackers to read arbitrary data from the database.","status":"published","published":"2026-11-05T06:34:37Z","modified":"2026-11-06T15:31:23Z","cvss":[{"version":"3.1","score":9.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N","level":"critical"}],"cwes":["CWE-89"],"updated_at":"2026-11-06T16:00:40.695019Z"}],"nvd":[{"id":"CVE-2026-100144","description":"The IVPAY payments WordPress plugin through 1.0.8 does not sanitise a value from its payment callback before using it in a SQL statement, and treats an empty API key, which is its own default, as valid authentication, allowing unauthenticated attackers to read arbitrary data from the database.","status":"published","published":"2026-11-05T06:17:06.64Z","modified":"2026-11-06T13:17:21.39Z","cvss":[{"version":"3.1","score":9.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N","level":"critical","assessor":"secondary"}],"cwes":["CWE-89"],"updated_at":"2026-11-06T16:00:36.254659Z"}]}}