Signal is active with 3 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
The IVPAY payments WordPress plugin through 1.0.8 does not sanitise a value from its payment callback before using it in a SQL statement, and treats an empty API key, which is its own default, as valid authentication, allowing unauthenticated attackers to read arbitrary data from the database.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
NONE
🆕 New CVE: CVE-2026-100144 (CVSS 9.3) Unknown IVPAY payments · Information disclosure Remote, no login needed. The IVPAY payments WordPress plugin through 1.0.8 does not sanitise a value from its payment callback before using it in a SQL statement… https://app.enclave.ai/threat-feed/CVE-2026-100144
🆕 New CVE IVPAY Payments: unauthenticated SQL injection in callback handler (CVE-2026-100144) An unauthenticated attacker could read arbitrary data from the site's database. No patch listed yet https://cve.now/CVE-2026-100144?utm_source=x&utm_medium=social&utm_campaign=cvedotnow&utm_content=critical
CVE-2026-100144: [dbu gs] Public exploit/PoC available. https://pranithjain.qzz.io/blog/exploit-cve-2026-100144-cve-2026-100144-dbugs-public-exploitpoc-