IVPAY payments WordPress plugin SQL injection
A WordPress payment plugin lets anyone without login peek into the database!
Summary
The IVPAY payments WordPress plugin uses a value from its payment callback in an SQL statement without sanitising it, and accepts an empty API key as valid authentication. Unauthenticated attackers can read arbitrary data from the site's database.
Affected when
- API key left empty (the plugin's default)
What to do
No known fix yet. Check that the plugin runs a version newer than 1.0.8 and read the vendor's advisory.
Products and platforms
CVE IDs
Sources
- Write-up: wpscan.com (opens in a new tab)
- CVE record: cve.org (opens in a new tab)
Times
First published
First seen