Live › vulnerability › CVE-2026-87838
Go to dashboardThe Wava Payment Plugin for WordPress, before 0.3.10, has a public REST endpoint with no authorisation, nonce or origin check. An unauthenticated attacker can overwrite the stored merchant credential, mark the integration as verified, and remove the payment method from checkout.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Stores running the Wava Payment Plugin for WordPress below version 0.3.10 are exposed, because the vulnerable endpoint is reachable without logging in. Sites without this plugin, or already on 0.3.10 or later, can skip it.
No product ranges from the sources yet.
0.3.10./wp-json/ and confirm whether an unauthenticated request to them changes settings (unknown which exact route the sources name).0.3.10 or later.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
The Wava Payment Plugin WordPress plugin before 0.3.10 does not perform any authorisation, nonce or origin verification on one of its public REST endpoints, allowing unauthenticated attackers to overwrite the stored credential that identifies the merchant account the store's payments are created against, to force the integration into a verified state the site owner never completed, and to remove the payment method from the store's checkout.
This page as .md · .json · in your agent: get_signal("CVE-2026-87838")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.