{"id":"CVE-2026-100144","title":"IVPAY payments <= 1.0.8 - Unauthenticated SQLi via 'payment_id' Parameter","summary":"The IVPAY payments WordPress plugin through 1.0.8 does not sanitise a value from its payment callback before using it in a SQL statement, and treats an empty API key, which is its own default, as valid authentication, allowing unauthenti…","severity":"critical","cvss":9.3,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N","cvssSource":"adp","cwe":["CWE-89"],"product":"IVPAY payments","affected":["ivpay_payments >= 1.0.0 <= 1.0.8"],"ssvc":{"exploitation":"none","automatable":"yes","technicalImpact":"partial","timestamp":"2026-11-06T11:54:52.896931Z"},"published":"2026-11-05","updated":"2026-11-06","sourceUpdated":"2026-11-06T12:08:30.452Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-100144","references":[{"url":"https://wpscan.com/vulnerability/d90db791-2223-480b-8d2f-b84170318fc4/"}],"tags":["cve.org"],"epss":0.00256,"epssPercentile":0.17327,"ingestedAt":"2026-11-05T21:36:00.788Z","slug":"CVE-2026-100144","body":"## Overview\n\nThe IVPAY payments WordPress plugin through 1.0.8 does not sanitise a value from its payment callback before using it in a SQL statement, and treats an empty API key, which is its own default, as valid authentication, allowing unauthenticated attackers to read arbitrary data from the database.\n\n## Affected\n\n- `ivpay_payments >= 1.0.0 <= 1.0.8`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"midnight","depthScore":51,"depthScoreParts":{"impact":51.2,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[{"seq":235040,"id":"CVE-2026-100144","ts":1793969518012,"field":"cvss","old":null,"new":"9.3"},{"seq":235039,"id":"CVE-2026-100144","ts":1793969518012,"field":"severity","old":"none","new":"critical"}]}