SQL Injection Vulnerability in IVPAY Payments WordPress Plugin
CVE-2026-100144
Currently unrated
Key Information:
- Vendor
WordPress
- Status
- Vendor
- CVE Published:
- 5 November 2026
Badges
👾 Exploit Exists🟡 Public PoC
What is CVE-2026-100144?
The IVPAY Payments WordPress plugin before version 1.0.8 is susceptible to SQL injection due to inadequate sanitization of inputs in the payment callback. This flaw allows unauthenticated attackers to exploit the vulnerability by supplying an empty API key—which the plugin mistakenly accepts as valid authentication. Consequently, attackers can gain unauthorized access to sensitive data stored in the database.
Affected Version(s)
IVPAY payments 1.0.0 <= 1.0.8
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.