External risk intelligence

IVPAY WordPress Plugin SQL Injection Allows Database Data Leakage

CVE advisorySeverity: CRITICAL (CVSS 9.3)

CVE-2026-100144

The vulnerability exists in a WordPress payments plugin, which is a component typically installed on public-facing web servers to facilitate transactions. Payment callbacks and associated API endpoints are designed to be reachable over the internet to process communications from payment gateways, making the vulnerable functionality inherently exposed to the public network.

SQL Injection

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This advisory details a critical vulnerability found in a WordPress payments plugin that could allow unauthenticated attackers to access sensitive database information. The issue stems from how the plugin handles payment callback data and its validation of API keys, potentially exposing an organization's data.

Unauthenticated access to database information.
Impacts online payment processing capabilities.
Verify plugin relevance and confirm exposure.

Attack Path

How an attacker could exploit the issue

An unauthenticated attacker could exploit this vulnerability by sending a specially crafted request to the plugin's payment callback. The plugin incorrectly validates an empty API key as legitimate authentication and fails to properly sanitize data from this callback before incorporating it into a database query. This could allow an attacker to read sensitive information from the WordPress database.

No authentication needed.
Payment callback with empty API key.
Read sensitive database data.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow unauthenticated attackers to read sensitive data from the website's database. This is possible because the plugin improperly handles payment callback information and treats an empty API key as valid authentication.

Sensitive database information could be exposed.
Attackers can exploit unauthenticated endpoints.
Unauthorized data access may occur.

Operational Fix

Recommended remediation, mitigation, and detection steps

The IVPAY payments WordPress plugin's SQL injection vulnerability requires immediate attention from teams managing public-facing web applications. The first step is to identify all instances of this plugin, determine their reachability and business criticality, and locate the accountable owner for remediation planning.

Website owners and security teams should own this.
Verify plugin presence and reachability.
Plan for vendor coordination and remediation.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the IVPAY payments plugin for WordPress?

IVPAY is a software extension designed for WordPress websites to manage transaction processing. It serves as a bridge between the website and payment gateways, enabling the site to handle customer checkout flows and process financial callbacks. Because it manages sensitive transaction data, it acts as a critical interface between a web application and external payment infrastructure.

How does CVE-2026-100144 lead to a SQL injection vulnerability?

This flaw is classified as CWE-89, or Improper Neutralization of Special Elements used in an SQL Command. The plugin takes input from a payment callback and inserts it directly into a database query without proper sanitization. Because the plugin also erroneously accepts a default, empty API key as valid credentials, an attacker can supply malicious SQL code through the callback to extract unauthorized information from the site's database.

Do I need to be logged in to trigger this vulnerability?

No. The vulnerability does not require any user privileges or administrative access. The plugin incorrectly validates an empty API key as authorized, meaning an attacker can simply send a specially crafted request to the payment callback endpoint. Note that this is a flaw in the plugin's logic; if the plugin is not installed or the specific callback functionality is entirely disabled, this specific trigger path is not available.

Is my WordPress site at risk if it uses this plugin?

According to Halo Surface Signal, this vulnerability is considered highly relevant because payment plugins are designed to be reachable over the internet to receive messages from payment gateways. This makes the affected functionality inherently exposed. If your site uses this plugin and is accessible to the public, the endpoint is likely reachable by unauthorized parties.

How should I respond to this threat?

Begin by auditing your environment to locate all instances of the IVPAY plugin. Once identified, prioritize these instances based on their role in your infrastructure. Reach out to the plugin vendor for updates or guidance, and consider disabling the affected functionality until a secure version is available to prevent unauthorized database access.

References

wpscan.com/vulnerability/d90db791-2223-480b-8d2f-b84170318fc4/

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.