{"affected":[{"defaultStatus":"unknown","product":"IVPAY payments","source":"CNA: WPScan","vendor":"Unknown","versions":[{"lessThanOrEqual":"1.0.8","status":"affected","version":"1.0.0","versionType":"semver"}]}],"cveId":"CVE-2026-100144","cwes":["CWE-89"],"description":"The IVPAY payments WordPress plugin through 1.0.8 does not sanitise a value from its payment callback before using it in a SQL statement, and treats an empty API key, which is its own default, as valid authentication, allowing unauthenticated attackers to read arbitrary data from the database.","epss":null,"exploits":[{"kind":"exploit","source":"CNA: WPScan","url":"https://wpscan.com/vulnerability/d90db791-2223-480b-8d2f-b84170318fc4/"}],"kev":null,"metrics":[],"modifiedAt":1793858428484,"publishedAt":1793858428484,"references":[{"source":"CNA: WPScan","tags":["exploit","vdb-entry","technical-description"],"url":"https://wpscan.com/vulnerability/d90db791-2223-480b-8d2f-b84170318fc4/"}],"remediation":[],"revision":"e39154792309d423398d5fad923e81f5c755aa7ac5b980a3117c049722b1b338","sources":[{"modifiedAt":1793858428484,"name":"CNA: WPScan","retrievedAt":1793858902806,"url":"https://www.cve.org/CVERecord?id=CVE-2026-100144"}],"ssvc":null,"status":"published","title":"IVPAY payments <= 1.0.8 - Unauthenticated SQLi via 'payment_id' Parameter","updatedAt":1793858902806}