PULSE
EN
FEED
ransomaoqin reclama a Sistel · BR · Technologyransombyod reclama a First and Final Warning - IHG Hotels & Resorts (Estate) · Hospitalityransomqilin reclama a Calvary Christian College · AU · Educationransomeverstake reclama a ne*****h.comransomauditteam reclama a kx***om · CN · Technologyransompixelleaks reclama a Disclosed · Otherransomdark project reclama a Custom Bakehouse · US · Retail & E-Commerceransomdestello reclama a MAPFRE Brasil 2026 · BR · Financial Servicesransomthegentlemen reclama a MKG Kirchrode · DE · Manufacturingransomn0n reclama a Delta Dental of Missouri · US · Healthcareransomn0n reclama a The Container Store · US · Retail & E-Commerceransomlockbit5 reclama a centratamagroup.com · BR · Otherransommedusalocker reclama a Msn · US · Technologyransommedusalocker reclama a baiapai · Technologyransomaoqin reclama a Sistel · BR · Technologyransombyod reclama a First and Final Warning - IHG Hotels & Resorts (Estate) · Hospitalityransomqilin reclama a Calvary Christian College · AU · Educationransomeverstake reclama a ne*****h.comransomauditteam reclama a kx***om · CN · Technologyransompixelleaks reclama a Disclosed · Otherransomdark project reclama a Custom Bakehouse · US · Retail & E-Commerceransomdestello reclama a MAPFRE Brasil 2026 · BR · Financial Servicesransomthegentlemen reclama a MKG Kirchrode · DE · Manufacturingransomn0n reclama a Delta Dental of Missouri · US · Healthcareransomn0n reclama a The Container Store · US · Retail & E-Commerceransomlockbit5 reclama a centratamagroup.com · BR · Otherransommedusalocker reclama a Msn · US · Technologyransommedusalocker reclama a baiapai · Technology
← Todos los CVEs
CVE Watch5 nov 2026

CVE-2026-100144

The IVPAY payments WordPress plugin through 1.0.8 does not sanitise a value from its payment callback before using it in a SQL statement, an

CVSS

—

Sin CVSS

EPSS

—

KEV

—

Exploit Today

0

0-100

Publicado: 5 nov 2026 · Última mod.: 5 nov 2026

EPSS · 30d

Sin historial EPSS suficiente todavía.

Descripción técnica

The IVPAY payments WordPress plugin through 1.0.8 does not sanitise a value from its payment callback before using it in a SQL statement, and treats an empty API key, which is its own default, as valid authentication, allowing unauthenticated attackers to read arbitrary data from the database.

Referencias oficiales
CVEs relacionados

Sin CVEs relacionados por CWE o producto.