Live › vulnerability › CVE-2026-87837
Go to dashboardThe Wava Payment Plugin for WordPress accepts payment-provider notifications without checking they are genuine or limiting who can send them. An unauthenticated attacker can mark any WooCommerce order as paid or cancel it, and in versions up to 0.3.7 also read customer names, addresses, emails and phone numbers.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Stores running the Wava Payment Plugin for WordPress below with WooCommerce. The plugin's notification endpoint is reachable by anyone on the internet, so any store using it should be treated as exposed until updated. Sites that do not use this plugin are not affected.
0.3.10No product ranges from the sources yet.
wp plugin get wava-payment-plugin --field=version (slug unknown from sources; confirm it)0.3.10 or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
The Wava Payment Plugin WordPress plugin before 0.3.10 does not verify the authenticity of incoming payment-provider notifications, nor restrict who may send them, allowing unauthenticated attackers to change the status of any WooCommerce order in the store, including marking an unpaid order as paid and completed, and cancelling other customers' orders.
In versions up to 0.3.7 the response additionally returns the affected order's billing details, disclosing customer names, addresses, email addresses and phone numbers to the same unauthenticated caller.
This page as .md · .json · in your agent: get_signal("CVE-2026-87837")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.