Kritik CVSS 9.3
CVE-2026-100144: CVE-2026-100144: SQL enjeksiyonu
Açıklama (NVD)
The IVPAY payments WordPress plugin through 1.0.8 does not sanitise a value from its payment callback before using it in a SQL statement, and treats an empty API key, which is its own default, as valid authentication, allowing unauthenticated attackers to read arbitrary data from the database.
Özet bilgiler
- CVSS v3.1
- 9.3
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N - EPSS
- %0,21 (yüzdelik 11)
- CWE
- CWE-89
- Yama
- Yok / bilinmiyor