CVE-2026-87838 — Wava Payment 0.3.1 - 0.3.9 - Unauthenticated Merchant Credential Overwrite via Install Webhook

CVE-2026-87838

Wava Payment 0.3.1 - 0.3.9 - Unauthenticated Merchant Credential Overwrite via Install Webhook PUBLISHED

Description (CNA)

The Wava Payment Plugin WordPress plugin before 0.3.10 does not perform any authorisation, nonce or origin verification on one of its public REST endpoints, allowing unauthenticated attackers to overwrite the stored credential that identifies the merchant account the store's payments are created against, to force the integration into a verified state the site owner never completed, and to remove the payment method from the store's checkout.

Affected (CNA)

Vendor / product	Versions
Unknown / Wava Payment Plugin	affected 0.3.1 before 0.3.10

CWE

No CWE identifiers supplied.

References

https://wpscan.com/vulnerability/96f247d7-3007-4728-9cd7-0ea52c96edb3/

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.