{"affected":[],"aliases":["CVE-2026-100144"],"database_specific":{"cwe_ids":[],"github_reviewed":false,"github_reviewed_at":null,"nvd_published_at":"2026-11-05T06:17:06Z","severity":null},"details":"The IVPAY payments WordPress plugin through 1.0.8 does not sanitise a value from its payment callback before using it in a SQL statement, and treats an empty API key, which is its own default, as valid authentication, allowing unauthenticated attackers to read arbitrary data from the database.","id":"GHSA-8q9v-ph95-jh42","modified":"2026-11-05T06:34:37Z","published":"2026-11-05T06:34:37Z","references":[{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-100144"},{"type":"WEB","url":"https://wpscan.com/vulnerability/d90db791-2223-480b-8d2f-b84170318fc4"}],"schema_version":"1.4.0","severity":[]}