CVE-2026-87838: Wava Payment 0.3.1 - 0.3.9 - Unauthenticated Merchant Credential Overwrite via Install Webhook

Q: Which installations are affected?

Wava Payment Plugin versions 0.3.1 through 0.3.9 are affected. The issue is fixed in version 0.3.10 or later.

Q: Does an attacker need a WordPress account or merchant access?

No. The affected public REST endpoint can be used without authentication, authorization, nonce validation, or origin verification.

Q: What could an attacker change?

An attacker can overwrite the stored credential used to identify the merchant account for created payments. They can also force the integration into a verified state that the site owner did not complete and remove the payment method from checkout.

Published Oct 21, 2026

Updated

The Wava Payment Plugin WordPress plugin before 0.3.10 does not perform any authorisation, nonce or origin verification on one of its public REST endpoints, allowing unauthenticated attackers to overwrite the stored credential that identifies the merchant account the store's payments are created against, to force the integration into a verified state the site owner never completed, and to remove the payment method from the store's checkout.

Affected Software

1 affected component

Wava Wava Payment Plugin>=0.3.1<=0.3.9

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Wava Payment Plugin for WordPress to a version that resolves this vulnerability.
Fixed in 0.3.10

Event History

Oct 21, 2026

CVE Published

via MITRE·06:00 AM

Data Sourced

via MITRE·06:00 AM

DescriptionWeakness

Frequently Asked Questions

Which installations are affected?

Wava Payment Plugin versions 0.3.1 through 0.3.9 are affected. The issue is fixed in version 0.3.10 or later.

Does an attacker need a WordPress account or merchant access?

No. The affected public REST endpoint can be used without authentication, authorization, nonce validation, or origin verification.

What could an attacker change?

An attacker can overwrite the stored credential used to identify the merchant account for created payments. They can also force the integration into a verified state that the site owner did not complete and remove the payment method from checkout.

CVE-2026-87838: Wava Payment 0.3.1 - 0.3.9 - Unauthenticated Merchant Credential Overwrite via Install Webhook

Affected Software

Remediation

Event History

Frequently Asked Questions

Which installations are affected?

Does an attacker need a WordPress account or merchant access?

What could an attacker change?

Company

Resources

Contact

Frequently Asked Questions

Which installations are affected?

Does an attacker need a WordPress account or merchant access?

What could an attacker change?