{"id":"CVE-2026-100144","kind":"vulnerability","aliases":["CVE-2026-100144"],"related":[],"title":"IVPAY WordPress plugin: unauthenticated SQL injection exposes the site database","description":"The IVPAY payments WordPress plugin through 1.0.8 does not sanitise a value from its payment callback before using it in a SQL statement, and treats an empty API key, which is its own default, as valid authentication, allowing unauthenticated attackers to read arbitrary data from the database.","summary":"The IVPAY payments WordPress plugin through 1.0.8 passes a value from its payment callback into a SQL statement without sanitising it. Because an empty API key is accepted as valid authentication, an unauthenticated attacker can read arbitrary data from the site's database.","severity":"high","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"ivendpay-payments","fixed":[],"affected":">= 1.0.0, <= 1.0.8","ecosystem":"wordpress"}],"ecosystems":[],"tags":["ivpay","package","payments","self-hosted","wordpress"],"not_affected_if":["plugin-above-1.0.8","plugin-not-installed"],"how_to_check":"- Look for wp-content/plugins/ivendpay-payments/ or IVPAY payments under Plugins in wp-admin; every released version (<=1.0.8) is listed as affected.\n- Check whether the IVPAY API key setting (WooCommerce > Settings > Payments > IVPAY) is empty: an empty key is accepted as valid authentication.\n- Check the wordpress.org plugin page: no release after 1.0.8 is listed, and a third-party tracker reports the plugin was closed on 2026-10-13.","fix":"No fixed version found; 1.0.8 is the latest release on wordpress.org. Remove the plugin or switch to another payment gateway until the vendor publishes a fix.","status":"open","published_at":"2026-11-05T06:17:06+00:00","first_seen_at":"2026-11-05T06:31:51+00:00","triaged_at":"2026-11-05T06:33:24+00:00","updated_at":"2026-11-05T06:34:26+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-11-05T06:33:24Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"IVPAY WordPress plugin: unauthenticated SQL injection exposes the site database","impact":"high","summary":"The IVPAY payments WordPress plugin through 1.0.8 passes a value from its payment callback into a SQL statement without sanitising it. Because an empty API key is accepted as valid authentication, an unauthenticated attacker can read arbitrary data from the site's database.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","ivpay","payments","self-hosted"],"confidence":0.7,"fix_status":"unknown","needs_auth":"no","worst_case":"unauthenticated attacker reads arbitrary data from the site database","analyst_note":"Confirm whether a fixed version or vendor patch exists and whether the empty API key default is still shipped, using the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-100144.","how_to_check":"- Check whether the IVPAY payments plugin is installed on the WordPress site, under Plugins in the admin or in `wp-content/plugins/`.\n- Check the installed plugin version against `1.0.8`; the sources say the flaw covers versions through `1.0.8`.\n- Check whether the plugin's API key setting is empty, since an empty key is accepted as authentication.","plain_action":"","needs_analyst":true,"not_affected_if":["plugin-not-installed","plugin-above-1.0.8"],"who_is_affected":"Sites running the IVPAY payments WordPress plugin at version 1.0.8 or earlier are exposed, because its payment callback handler reaches the database without sanitising input and accepts an empty API key. Sites without this plugin are not affected. The sources do not state a fixed version or a vendor patch.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000751,"input_tokens":4214,"output_tokens":659,"severity_before":"unknown"},"analyst_status":"done","analyst_note":"Confirm whether a fixed version or vendor patch exists and whether the empty API key default is still shipped, using the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-100144.","search":"'-100144':13A,16A '-2026':12A,15A '1.0.8':33B,76C 'accept':54B 'allow':107C 'api':51B,97C 'arbitrari':63B,112C 'attack':60B,109C 'authent':57B,106C 'callback':40B,85C 'cve':11A,14A 'data':64B,113C 'databas':10A,69B,116C 'default':103C 'empti':50B,96C 'expos':7A 'host':25B 'inject':6A 'ivendpay':18A 'ivendpay-payments':17A 'ivpay':1A,20B,28B,71C 'key':52B,98C 'packag':21B 'pass':34B 'payment':22B,29B,39B,72C,84C 'payments':19A 'plugin':3A,31B,74C 'read':62B,111C 'sanitis':46B,79C 'self':24B 'self-host':23B 'site':9A,67B 'sql':5A,43B,91C 'statement':44B,92C 'treat':94C 'unauthent':4A,59B,108C 'use':87C 'valid':56B,105C 'valu':36B,81C 'without':45B 'wordpress':2A,26B,30B,73C","nicknames":[],"mitigations":[],"who_affected":"WordPress/WooCommerce sites running the IVPAY payments plugin (slug ivendpay-payments), version 1.0.8 or earlier, which is every released version. The payment callback is reachable without login and accepts an empty API key (the default), so an attacker can read the site database. Sites without the plugin can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":["ivendpaypayments"],"ptokens":["ivendpay","payments"],"labels":["high","ivpay","package","payments","selfhosted","wordpress"],"campaign_type":null,"first_public_at":"2026-11-05T06:17:06+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-100144","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-100144","severity":null,"published_at":"2026-11-05T06:17:06+00:00","modified_at":"2026-11-05T06:17:06+00:00","first_seen_at":"2026-11-05T06:31:51+00:00","fetched_at":"2026-11-05T06:31:51+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-100144:1761","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-100144","severity":null,"published_at":"2026-11-05T06:34:26+00:00","modified_at":"2026-11-05T06:34:26+00:00","first_seen_at":"2026-11-05T06:34:26+00:00","fetched_at":"2026-11-05T06:34:26+00:00","note":"NVD (WPScan-sourced) says <=1.0.8 affected. wp.org page: 1.0.8 (Oct 2024) is the latest release, no later version; third-party tracker says wp.org closed the plugin 2026-10-13. No vendor advisory found, so fix left unknown, nothing verified. ~10-18 installs.","cites":["https://nvd.nist.gov/vuln/detail/CVE-2026-100144","https://wordpress.org/plugins/ivendpay-payments/","https://plugins.wpmayor.com/plugin/ivendpay-payments"]}],"documents":[{"id":73853,"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-100144","title":"NVD CVE-2026-100144","kind":"advisory","source":"analyst","publisher":null,"text":"The IVPAY payments WordPress plugin through 1.0.8 does not sanitise a value from its payment callback before using it in a SQL statement, and treats an empty API key, which is its own default, as valid authentication, allowing unauthenticated attackers to read arbitrary data from the database. Source: WPScan (https://wpscan.com/vulnerability/d90db791-2223-480b-8d2f-b84170318fc4/). Affected 1.0.0 to 1.0.8.","published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":73854,"url":"https://wordpress.org/plugins/ivendpay-payments/","title":"IVPAY payments - WordPress.org plugin page","kind":"vendor","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"describes","confidence":null,"note":null},{"id":73855,"url":"https://plugins.wpmayor.com/plugin/ivendpay-payments","title":"IVPAY payments - Plugin Pulse (closed on wp.org 2026-10-13)","kind":"other","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"mentions","confidence":null,"note":null}],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}