CVE-2026-87837Wava Payment 0.3.1 - 0.3.9 - Unauthenticated Order Status Change via Payment Webhook
Updated under an hour ago ()
Does this affect you?
It affects Unknown Wava Payment Plugin. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
The Wava Payment Plugin WordPress plugin before 0.3.10 does not verify the authenticity of incoming payment-provider notifications, nor restrict who may send them, allowing unauthenticated attackers to change the status of any WooCommerce order in the store, including marking an unpaid order as paid and completed, and cancelling other customers' orders. In versions up to 0.3.7 the response additionally returns the affected order's billing details, disclosing customer names, addresses, email addresses and phone numbers to the same unauthenticated caller.
- CVSS
- 5.3 MEDIUM (v3.1, CISA ADP)CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
- Weakness (CWE)
- CWE-862
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- WPScan
- NVD analysis
- Deferred
- Record last updated
- Oct 21, 2026
- First seen by InfoSec Signals
- Oct 21, 2026
Affected products
Unknown Wava Payment Plugin unknown:wava_payment_plugin (from the name) | from 0.3.1 before 0.3.10 | CNA record |
References
- https://wpscan.com/vulnerability/76da1b69-aa79-4e9e-a97a-bbaefdeb65fe/exploit, vdb-entry, technical-description
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.