---
id: "CVE-2026-100144"
kind: "vulnerability"
aliases: ["CVE-2026-100144"]
title: "IVPAY WordPress plugin: unauthenticated SQL injection exposes the site database"
severity: "high"
cvss: null
epss: null
exploited: false
status: "open"
category: "package"
products: [{"name": "ivendpay-payments", "fixed": [], "affected": ">= 1.0.0, <= 1.0.8", "ecosystem": "wordpress"}]
ecosystems: []
tags: ["ivpay", "package", "payments", "self-hosted", "wordpress"]
not_affected_if: ["plugin-above-1.0.8", "plugin-not-installed"]
published_at: "2026-11-05T06:17:06+00:00"
first_seen_at: "2026-11-05T06:31:51+00:00"
updated_at: "2026-11-05T06:34:26+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-100144", "first_seen_at": "2026-11-05T06:31:51+00:00"}, {"source": "analyst", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-100144", "first_seen_at": "2026-11-05T06:34:26+00:00", "cites": ["https://nvd.nist.gov/vuln/detail/CVE-2026-100144", "https://wordpress.org/plugins/ivendpay-payments/", "https://plugins.wpmayor.com/plugin/ivendpay-payments"]}]
exploit_sources: []
---

# IVPAY WordPress plugin: unauthenticated SQL injection exposes the site database

The IVPAY payments WordPress plugin through 1.0.8 passes a value from its payment callback into a SQL statement without sanitising it. Because an empty API key is accepted as valid authentication, an unauthenticated attacker can read arbitrary data from the site's database.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- wordpress:ivendpay-payments affected >= 1.0.0, <= 1.0.8 fixed no fixed version listed

## How to check

- Look for wp-content/plugins/ivendpay-payments/ or IVPAY payments under Plugins in wp-admin; every released version (<=1.0.8) is listed as affected.
- Check whether the IVPAY API key setting (WooCommerce > Settings > Payments > IVPAY) is empty: an empty key is accepted as valid authentication.
- Check the wordpress.org plugin page: no release after 1.0.8 is listed, and a third-party tracker reports the plugin was closed on 2026-10-13.

## Fix

No fixed version found; 1.0.8 is the latest release on wordpress.org. Remove the plugin or switch to another payment gateway until the vendor publishes a fix.

## Timeline

- 2026-11-05T06:31:51+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-100144
- 2026-11-05T06:34:26+00:00 analyst https://nvd.nist.gov/vuln/detail/CVE-2026-100144 — NVD (WPScan-sourced) says <=1.0.8 affected. wp.org page: 1.0.8 (Oct 2024) is the latest release, no later version; third-party tracker says wp.org closed the plugin 2026-10-13. No vendor advisory found, so fix left unknown, nothing verified. ~10-18 installs.

## Documents

- [advisory] NVD CVE-2026-100144 https://nvd.nist.gov/vuln/detail/CVE-2026-100144
- [describes] IVPAY payments - WordPress.org plugin page https://wordpress.org/plugins/ivendpay-payments/
- [mentions] IVPAY payments - Plugin Pulse (closed on wp.org 2026-10-13) https://plugins.wpmayor.com/plugin/ivendpay-payments

## From the sources

The IVPAY payments WordPress plugin through 1.0.8 does not sanitise a value from its payment callback before using it in a SQL statement, and treats an empty API key, which is its own default, as valid authentication, allowing unauthenticated attackers to read arbitrary data from the database.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_