{"id":"CVE-2026-87837","kind":"vulnerability","aliases":["CVE-2026-87837"],"related":[],"title":"Wava Payment WordPress plugin lets anyone change WooCommerce order status","description":"The Wava Payment Plugin WordPress plugin before 0.3.10 does not verify the authenticity of incoming payment-provider notifications, nor restrict who may send them, allowing unauthenticated attackers to change the status of any WooCommerce order in the store, including marking an unpaid order as paid and completed, and cancelling other customers' orders.\n\nIn versions up to 0.3.7 the response additionally returns the affected order's billing details, disclosing customer names, addresses, email addresses and phone numbers to the same unauthenticated caller.","summary":"The Wava Payment Plugin for WordPress accepts payment-provider notifications without checking they are genuine or limiting who can send them. An unauthenticated attacker can mark any WooCommerce order as paid or cancel it, and in versions up to 0.3.7 also read customer names, addresses, emails and phone numbers.","severity":"medium","cvss":5.3,"epss":0.0019,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["ecommerce","package","wava-payment-plugin","woocommerce","wordpress"],"not_affected_if":["plugin-not-installed","version-0.3.10-or-later"],"how_to_check":"- Check the installed Wava Payment plugin version in the WordPress admin Plugins screen or with `wp plugin get wava-payment-plugin --field=version` (slug unknown from sources; confirm it)\n- Confirm whether the plugin is active on a WooCommerce store that accepts Wava payments","fix":"- Update the Wava Payment Plugin to `0.3.10` or later\n- If an update is not possible, deactivate the plugin until it is updated","status":"open","published_at":"2026-10-21T06:16:50+00:00","first_seen_at":"2026-10-23T21:57:28+00:00","triaged_at":"2026-10-25T04:21:08+00:00","updated_at":"2026-10-25T04:21:08+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-10-25T04:21:08Z","model":"claude-haiku-5-5","output":{"fix":"- Update the Wava Payment Plugin to `0.3.10` or later\n- If an update is not possible, deactivate the plugin until it is updated","reach":"internet","title":"Wava Payment WordPress plugin lets anyone change WooCommerce order status","impact":"medium","summary":"The Wava Payment Plugin for WordPress accepts payment-provider notifications without checking they are genuine or limiting who can send them. An unauthenticated attacker can mark any WooCommerce order as paid or cancel it, and in versions up to 0.3.7 also read customer names, addresses, emails and phone numbers.","category":"package","nicknames":[],"who_cares":["wordpress","woocommerce","wava-payment-plugin","ecommerce"],"confidence":0.8,"needs_auth":"no","worst_case":"Attacker marks orders paid, cancels others, and reads customer contact details","analyst_note":"","how_to_check":"- Check the installed Wava Payment plugin version in the WordPress admin Plugins screen or with `wp plugin get wava-payment-plugin --field=version` (slug unknown from sources; confirm it)\n- Confirm whether the plugin is active on a WooCommerce store that accepts Wava payments","needs_analyst":false,"not_affected_if":["plugin-not-installed","version-0.3.10-or-later"],"who_is_affected":"Stores running the Wava Payment Plugin for WordPress below `0.3.10` with WooCommerce. The plugin's notification endpoint is reachable by anyone on the internet, so any store using it should be treated as exposed until updated. Sites that do not use this plugin are not affected.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000647,"input_tokens":3443,"output_tokens":605,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':12A,15A '-87837':13A,16A '0.3.10':82C '0.3.7':65B,132C 'accept':31B 'addit':135C 'address':70B,146C,148C 'affect':138C 'allow':100C 'also':66B 'anyon':6A 'attack':49B,102C 'authent':87C 'bill':141C 'caller':156C 'cancel':58B,124C 'chang':7A,104C 'check':37B 'complet':122C 'custom':68B,126C,144C 'cve':11A,14A 'detail':142C 'disclos':143C 'ecommerc':17B 'email':71B,147C 'genuin':40B 'includ':114C 'incom':89C 'let':5A 'limit':42B 'mark':51B,115C 'may':97C 'name':69B,145C 'notif':35B,93C 'number':74B,151C 'order':9A,54B,110C,118C,127C,139C 'packag':18B 'paid':56B,120C 'payment':2A,21B,27B,33B,77C,91C 'payment-provid':32B,90C 'phone':73B,150C 'plugin':4A,22B,28B,78C,80C 'provid':34B,92C 'read':67B 'respons':134C 'restrict':95C 'return':136C 'send':45B,98C 'status':10A,106C 'store':113C 'unauthent':48B,101C,155C 'unpaid':117C 'verifi':85C 'version':62B,129C 'wava':1A,20B,26B,76C 'wava-payment-plugin':19B 'without':36B 'woocommerc':8A,23B,53B,109C 'wordpress':3A,24B,30B,79C","nicknames":[],"mitigations":[],"who_affected":"Stores running the Wava Payment Plugin for WordPress below `0.3.10` with WooCommerce. The plugin's notification endpoint is reachable by anyone on the internet, so any store using it should be treated as exposed until updated. Sites that do not use this plugin are not affected.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-21T06:16:50+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","cvss_by":"134c704f-9b21-4f2e-91b3-4a467353bcc0","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-87837","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-87837","severity":null,"published_at":"2026-10-21T06:16:50+00:00","modified_at":"2026-10-21T18:37:38+00:00","first_seen_at":"2026-10-23T21:57:28+00:00","fetched_at":"2026-10-23T22:29:01+00:00","note":null},{"source":"epss","external_id":"CVE-2026-87837","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-87837","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T13:15:54+00:00","fetched_at":"2026-10-24T13:15:54+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}