[ CVE-2026-100144 · Published 5 Nov 2026 ]
Vulnerability in Unknown IVPAY payments
Not scored yet
No fix listed yet
[ Description ]Official description
The IVPAY payments WordPress plugin through 1.0.8 does not sanitise a value from its payment callback before using it in a SQL statement, and treats an empty API key, which is its own default, as valid authentication, allowing unauthenticated attackers to read arbitrary data from the database.
[ Fixes ]Fixes and patches
No fix or interim patch is linked from our sources yet. Check the vendor references below and limit exposure of affected systems until a fix is available.