Unrated severityNVD Advisory· Published Nov 5, 2026
CVE-2026-100144
CVE-2026-100144
Description
The IVPAY payments WordPress plugin through 1.0.8 does not sanitise a value from its payment callback before using it in a SQL statement, and treats an empty API key, which is its own default, as valid authentication, allowing unauthenticated attackers to read arbitrary data from the database.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
1- Range: <=1.0.8
Patches
Vulnerability mechanics
References
1News mentions
0No linked articles in our index yet.