{"cve":"CVE-2026-100144","enrichment":{"created":"2026-11-05T07:30:14.787352+00:00","updated":"2026-11-05T07:30:14.787357+00:00","vendors":[],"weaknesses":["CWE-89"]},"mitre":{"cpes":[],"created":"2026-11-05T06:00:28.484000+00:00","description":"The IVPAY payments WordPress plugin through 1.0.8 does not sanitise a value from its payment callback before using it in a SQL statement, and treats an empty API key, which is its own default, as valid authentication, allowing unauthenticated attackers to read arbitrary data from the database.","metrics":{"cvssV2_0":{},"cvssV3_0":{},"cvssV3_1":{},"cvssV4_0":{}},"mitre_repo_path":"cves/2026/100xxx/CVE-2026-100144.json","references":["https://wpscan.com/vulnerability/d90db791-2223-480b-8d2f-b84170318fc4/"],"title":"IVPAY payments <= 1.0.8 - Unauthenticated SQLi via 'payment_id' Parameter","updated":"2026-11-05T06:00:28.484000+00:00","vendors":[],"weaknesses":[]},"nvd":{"cpes":[],"created":"2026-11-05T06:17:06.640000+00:00","description":"The IVPAY payments WordPress plugin through 1.0.8 does not sanitise a value from its payment callback before using it in a SQL statement, and treats an empty API key, which is its own default, as valid authentication, allowing unauthenticated attackers to read arbitrary data from the database.","metrics":{"cvssV2_0":{},"cvssV3_0":{},"cvssV3_1":{},"cvssV4_0":{}},"nvd_repo_path":"2026/CVE-2026-100144.json","references":["https://wpscan.com/vulnerability/d90db791-2223-480b-8d2f-b84170318fc4/"],"title":null,"updated":"2026-11-05T06:17:06.640000+00:00","vendors":[],"weaknesses":[]},"opencve":{"changes":[{"created":"2026-11-05T06:15:00+00:00","data":[{"details":{"new":"The IVPAY payments WordPress plugin through 1.0.8 does not sanitise a value from its payment callback before using it in a SQL statement, and treats an empty API key, which is its own default, as valid authentication, allowing unauthenticated attackers to read arbitrary data from the database.","old":null},"type":"description"},{"details":{"new":"IVPAY payments <= 1.0.8 - Unauthenticated SQLi via 'payment_id' Parameter","old":null},"type":"title"},{"details":{"added":["https://wpscan.com/vulnerability/d90db791-2223-480b-8d2f-b84170318fc4/"],"removed":[]},"type":"references"}],"id":"97d5ebf2-335a-46fe-81bf-4464a6ede3ed"},{"created":"2026-11-05T07:45:00+00:00","data":[{"details":{"added":["CWE-89"],"removed":[]},"type":"weaknesses"}],"id":"489ffb2f-b52a-4f5b-a255-71f251d77f82"}],"cpes":{"data":[],"providers":[]},"created":{"data":"2026-11-05T06:00:28.484000+00:00","provider":"mitre"},"description":{"data":"The IVPAY payments WordPress plugin through 1.0.8 does not sanitise a value from its payment callback before using it in a SQL statement, and treats an empty API key, which is its own default, as valid authentication, allowing unauthenticated attackers to read arbitrary data from the database.","provider":"mitre"},"metrics":{"cvssV2_0":{"data":{},"provider":null},"cvssV3_0":{"data":{},"provider":null},"cvssV3_1":{"data":{},"provider":null},"cvssV4_0":{"data":{},"provider":null},"epss":{"data":{},"provider":null},"kev":{"data":{},"provider":null},"ssvc":{"data":{},"provider":null},"threat_severity":{"data":null,"provider":null}},"references":{"data":["https://wpscan.com/vulnerability/d90db791-2223-480b-8d2f-b84170318fc4/"],"providers":["mitre","nvd"]},"title":{"data":"IVPAY payments <= 1.0.8 - Unauthenticated SQLi via 'payment_id' Parameter","provider":"mitre"},"updated":{"data":"2026-11-05T07:30:14.787357+00:00","provider":"enrichment"},"vendors":{"data":[],"providers":[]},"weaknesses":{"data":["CWE-89"],"providers":["enrichment"]}}}