CVE-2026-87838: medium-severity vulnerability in Wava Payment Plugin
Wava Payment 0.3.1 - 0.3.9 - Unauthenticated Merchant Credential Overwrite via Install Webhook
Published
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
33Vexday Risk Score
No sign of exploitation. It has a public proof of concept.
ssvc Attendcvss 6.5epss 0.3%
The Wava Payment Plugin WordPress plugin before 0.3.10 does not perform any authorisation, nonce or origin verification on one of its public REST endpoints, allowing unauthenticated attackers to overwrite the stored credential that identifies the merchant account the store's payments are created against, to force the integration into a verified state the site owner never completed, and to remove the payment method from the store's checkout.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L
Affected products
Unknown · Wava Payment Pluginpublic PoCs found — 1
cve_referencewpscan.com/vulnerability/96f247d7-3007-4728-9cd7-0ea52c96edb3/unverified⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — Wava Payment Plugin
In the same product, most dangerous first.