{"id":"CVE-2026-87838","kind":"vulnerability","aliases":["CVE-2026-87838"],"related":[],"title":"Wava Payment WordPress plugin: unauthenticated REST endpoint rewrites merchant credentials","description":"The Wava Payment Plugin WordPress plugin before 0.3.10 does not perform any authorisation, nonce or origin verification on one of its public REST endpoints, allowing unauthenticated attackers to overwrite the stored credential that identifies the merchant account the store's payments are created against, to force the integration into a verified state the site owner never completed, and to remove the payment method from the store's checkout.","summary":"The Wava Payment Plugin for WordPress, before 0.3.10, has a public REST endpoint with no authorisation, nonce or origin check. An unauthenticated attacker can overwrite the stored merchant credential, mark the integration as verified, and remove the payment method from checkout.","severity":"medium","cvss":6.5,"epss":0.00212,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["package","payments","self-hosted","woocommerce","wordpress"],"not_affected_if":["plugin-not-installed","version-0.3.10-or-later"],"how_to_check":"- Check the installed version of the Wava Payment Plugin in the WordPress admin plugins list; it is affected if it is below `0.3.10`.\n- Look for the plugin's REST routes under `/wp-json/` and confirm whether an unauthenticated request to them changes settings (unknown which exact route the sources name).","fix":"- Update the Wava Payment Plugin to `0.3.10` or later.\n- If you cannot update now, disable the plugin and rotate the merchant credential in the Wava account.","status":"open","published_at":"2026-10-21T06:16:50+00:00","first_seen_at":"2026-10-23T21:57:28+00:00","triaged_at":"2026-10-25T03:49:07+00:00","updated_at":"2026-10-25T03:49:07+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-25T03:49:07Z","model":"claude-haiku-5-5","output":{"fix":"- Update the Wava Payment Plugin to `0.3.10` or later.\n- If you cannot update now, disable the plugin and rotate the merchant credential in the Wava account.","reach":"internet","title":"Wava Payment WordPress plugin: unauthenticated REST endpoint rewrites merchant credentials","impact":"medium","summary":"The Wava Payment Plugin for WordPress, before 0.3.10, has a public REST endpoint with no authorisation, nonce or origin check. An unauthenticated attacker can overwrite the stored merchant credential, mark the integration as verified, and remove the payment method from checkout.","category":"package","nicknames":[],"who_cares":["wordpress","woocommerce","payments","self-hosted"],"confidence":0.7,"needs_auth":"no","worst_case":"Attacker rewrites payment merchant credential and removes checkout payment method","analyst_note":"","how_to_check":"- Check the installed version of the Wava Payment Plugin in the WordPress admin plugins list; it is affected if it is below `0.3.10`.\n- Look for the plugin's REST routes under `/wp-json/` and confirm whether an unauthenticated request to them changes settings (unknown which exact route the sources name).","needs_analyst":false,"not_affected_if":["plugin-not-installed","version-0.3.10-or-later"],"who_is_affected":"Stores running the Wava Payment Plugin for WordPress below version 0.3.10 are exposed, because the vulnerable endpoint is reachable without logging in. Sites without this plugin, or already on 0.3.10 or later, can skip it.","user_interaction":"no","needs_special_setup":"no","severity_if_unknown":"medium"},"cost_usd":0.000637,"input_tokens":3393,"output_tokens":596,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':12A,15A '-87838':13A,16A '0.3.10':31B,72C 'account':101C 'allow':89C 'attack':46B,91C 'authoris':39B,77C 'check':43B 'checkout':64B,132C 'complet':121C 'creat':107C 'credenti':10A,52B,96C 'cve':11A,14A 'endpoint':7A,36B,88C 'forc':110C 'host':21B 'identifi':98C 'integr':55B,112C 'mark':53B 'merchant':9A,51B,100C 'method':62B,127C 'never':120C 'nonc':40B,78C 'one':83C 'origin':42B,80C 'overwrit':48B,93C 'owner':119C 'packag':17B 'payment':2A,18B,26B,61B,67C,105C,126C 'perform':75C 'plugin':4A,27B,68C,70C 'public':34B,86C 'remov':59B,124C 'rest':6A,35B,87C 'rewrit':8A 'self':20B 'self-host':19B 'site':118C 'state':116C 'store':50B,95C,103C,130C 'unauthent':5A,45B,90C 'verif':81C 'verifi':57B,115C 'wava':1A,25B,66C 'woocommerc':22B 'wordpress':3A,23B,29B,69C","nicknames":[],"mitigations":[],"who_affected":"Stores running the Wava Payment Plugin for WordPress below version 0.3.10 are exposed, because the vulnerable endpoint is reachable without logging in. Sites without this plugin, or already on 0.3.10 or later, can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-21T06:16:50+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L","cvss_by":"134c704f-9b21-4f2e-91b3-4a467353bcc0","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-87838","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-87838","severity":null,"published_at":"2026-10-21T06:16:50+00:00","modified_at":"2026-10-21T18:37:38+00:00","first_seen_at":"2026-10-23T21:57:28+00:00","fetched_at":"2026-10-23T22:29:01+00:00","note":null},{"source":"epss","external_id":"CVE-2026-87838","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-87838","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T13:15:54+00:00","fetched_at":"2026-10-24T13:15:54+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}