CVE-2026-87838
Wava Payment 0.3.1 - 0.3.9 - Unauthenticated Merchant Credential Overwrite via Install Webhook
CVSS Score
0.0
EPSS Score
0.0%
EPSS Percentile
0th
The Wava Payment Plugin WordPress plugin before 0.3.10 does not perform any authorisation, nonce or origin verification on one of its public REST endpoints, allowing unauthenticated attackers to overwrite the stored credential that identifies the merchant account the store's payments are created against, to force the integration into a verified state the site owner never completed, and to remove the payment method from the store's checkout.
| Vendor | unknown |
| Product | wava payment plugin |
| Published | Oct 21, 2026 |
Stay Ahead of the Next One
Get instant alerts for unknown wava payment plugin
Be the first to know when new unknown vulnerabilities affecting unknown wava payment plugin are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
Affected Versions
Unknown / Wava Payment Plugin
0.3.1 < 0.3.10
References
Credits
Pablo González Pérez Francisco José Ramírez Vicente and Iñigo Sánchez Enciso WPScan