Dashboard / CVE-2026-100144

CVE-2026-100144

CRITICAL
INFO Priority: 0.02 BB Relevance: 79/100
Published: 2026-11-05 Modified: 2026-11-06 First seen: 2026-11-05 Status: active

Attack Surface

Network Low Complexity No Auth No Interaction Conf. Impact Scope Change

CVSS Vector Breakdown

AV: Network
AC: Low
PR: None
UI: None
S: Changed
C: High
I: Low
A: None

Description

The IVPAY payments WordPress plugin through 1.0.8 does not sanitise a value from its payment callback before using it in a SQL statement, and treats an empty API key, which is its own default, as valid authentication, allowing unauthenticated attackers to read arbitrary data from the database.

Weakness Classification (1)

Affected Software (2)

VendorProductVersion
Unknown IVPAY payments 1.0.0
Unknown IVPAY payments 1.0.0

References & Advisories (1)

Bug Bounty Relevance

79 / 100
✓ Network accessible
✓ No authentication
✓ Low complexity
✓ No user interaction

CVSS Score

9.3 / 10.0 v3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N

EPSS — Exploitation Probability

0.21%
Raw Score 0.002080
Percentile 11.0%
Date 2026-11-06

EPSS Trend

2026-11-06
0.00208
2026-11-05
0.00208

Intelligence Sources

mitre ref →
nvd ref →

External Links