---
id: "CVE-2026-87837"
kind: "vulnerability"
aliases: ["CVE-2026-87837"]
title: "Wava Payment WordPress plugin lets anyone change WooCommerce order status"
severity: "medium"
cvss: 5.3
epss: 0.0019
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["ecommerce", "package", "wava-payment-plugin", "woocommerce", "wordpress"]
not_affected_if: ["plugin-not-installed", "version-0.3.10-or-later"]
published_at: "2026-10-21T06:16:50+00:00"
first_seen_at: "2026-10-23T21:57:28+00:00"
updated_at: "2026-10-25T04:21:08+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-87837", "first_seen_at": "2026-10-23T21:57:28+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-87837", "first_seen_at": "2026-10-24T13:15:54+00:00"}]
---

# Wava Payment WordPress plugin lets anyone change WooCommerce order status

The Wava Payment Plugin for WordPress accepts payment-provider notifications without checking they are genuine or limiting who can send them. An unauthenticated attacker can mark any WooCommerce order as paid or cancel it, and in versions up to 0.3.7 also read customer names, addresses, emails and phone numbers.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed Wava Payment plugin version in the WordPress admin Plugins screen or with `wp plugin get wava-payment-plugin --field=version` (slug unknown from sources; confirm it)
- Confirm whether the plugin is active on a WooCommerce store that accepts Wava payments

## Fix

- Update the Wava Payment Plugin to `0.3.10` or later
- If an update is not possible, deactivate the plugin until it is updated

## Timeline

- 2026-10-23T21:57:28+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-87837
- 2026-10-24T13:15:54+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-87837

## From the sources

The Wava Payment Plugin WordPress plugin before 0.3.10 does not verify the authenticity of incoming payment-provider notifications, nor restrict who may send them, allowing unauthenticated attackers to change the status of any WooCommerce order in the store, including marking an unpaid order as paid and completed, and cancelling other customers' orders.

In versions up to 0.3.7 the response additionally returns the affected order's billing details, disclosing customer names, addresses, email addresses and phone numbers to the same unauthenticated caller.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_