ivpay_payments vulnerabilities

CVEs whose affected-version data names the ivpay_payments package. Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.

1 CVERSS

CVE-2026-100144Critical· 9.3

2d ago

IVPAY payments <= 1.0.8 - Unauthenticated SQLi via 'payment_id' Parameter

The IVPAY payments WordPress plugin through 1.0.8 does not sanitise a value from its payment callback before using it in a SQL statement, and treats an empty API key, which is its own default, as valid authentication, allowing unauthenti…

▾ MidnightEPSS 0.26%via CVEORG