Skip to content
Sign in
6.5 Medium

CVE-2026-87838 The Wava Payment Plugin WordPress plugin before 0.3.10 does not perform any authorisation, nonce or origin…

Description

The Wava Payment Plugin WordPress plugin before 0.3.10 does not perform any authorisation, nonce or origin verification on one of its public REST endpoints, allowing unauthenticated attackers to overwrite the stored credential that identifies the merchant account the store's payments are created against, to force the integration into a verified state the site owner never completed, and to remove the payment method from the store's checkout.

Affected products and versions

Product Affected versions Fixed in
Wava Payment Plugin 0.3 0.3.1 → < 0.3.10 0.3.10

Other CVEs of Wava Payment Plugin

The 2 CVEs of Wava Payment Plugin →
CVE-2026-87837 The Wava Payment Plugin WordPress plugin before 0.3.10 does not verify the authenticity of incoming payment-provider… 5.3 Medium
Track this CVE