CVE-2026-87837: Wava Payment 0.3.1 - 0.3.9 - Unauthenticated Order Status Change via Payment Webhook
The Wava Payment Plugin WordPress plugin before 0.3.10 does not verify the authenticity of incoming payment-provider notifications, nor restrict who may send them, allowing unauthenticated attackers to change the status of any WooCommerce order in the store, including marking an unpaid order as paid and completed, and cancelling other customers' orders.
In versions up to 0.3.7 the response additionally returns the affected order's billing details, disclosing customer names, addresses, email addresses and phone numbers to the same unauthenticated caller.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Wava Payment Pluginto a version that resolves this vulnerability.Fixed in 0.3.10
Event History
Frequently Asked Questions
Which installations are affected?
Wava Payment Plugin versions 0.3.1 through 0.3.9 are affected. Version 0.3.10 is not described as affected.
Does an attacker need an account or payment-provider credentials?
No. Incoming payment-provider notifications are not authenticated and are not restricted by sender, so an unauthenticated attacker can submit them.
What can an attacker change?
An attacker can alter the status of any WooCommerce order, including marking an unpaid order as paid and completed or cancelling other customers' orders.
Is customer information exposed?
In versions through 0.3.7, the response also returns billing details for the affected order to the unauthenticated caller. This can disclose customer names, addresses, email addresses, and phone numbers.
What is the available remediation?
Update the Wava Payment Plugin to version 0.3.10 or later.