Wava Payment 0.3.1 - 0.3.9 - Unauthenticated Order Status Change via Payment Webhook
The Wava Payment Plugin WordPress plugin before 0.3.10 does not verify the authenticity of incoming payment-provider notifications, nor restrict who may send them, allowing unauthenticated attackers to change the status of any WooCommerce order in the store, including marking an unpaid order as paid and completed, and cancelling other customers' orders. In versions up to 0.3.7 the response additionally returns the affected order's billing details, disclosing customer names, addresses, email addresses and phone numbers to the same unauthenticated caller.
CVE-2026-87837
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: cve:CVE-2026-87837
Wava Payment Plugin
Source reference: /containers/cna/affected/0/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"vendor": "Unknown",
"product": "Wava Payment Plugin",
"versions": [
{
"status": "affected",
"version": "0.3.1",
"lessThan": "0.3.10",
"versionType": "semver"
}
],
"defaultStatus": "unaffected"
}
]- Related CVEs
- CVE-2026-87837
Source reference:
/cveMetadata/cveId
Publisher severity
No explicit severity was provided.
- Event
- #45812 · Revision 1
- Added to Heist Feed
- Publisher date