---
id: "CVE-2026-87838"
kind: "vulnerability"
aliases: ["CVE-2026-87838"]
title: "Wava Payment WordPress plugin: unauthenticated REST endpoint rewrites merchant credentials"
severity: "medium"
cvss: 6.5
epss: 0.00212
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["package", "payments", "self-hosted", "woocommerce", "wordpress"]
not_affected_if: ["plugin-not-installed", "version-0.3.10-or-later"]
published_at: "2026-10-21T06:16:50+00:00"
first_seen_at: "2026-10-23T21:57:28+00:00"
updated_at: "2026-10-25T03:49:07+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-87838", "first_seen_at": "2026-10-23T21:57:28+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-87838", "first_seen_at": "2026-10-24T13:15:54+00:00"}]
---

# Wava Payment WordPress plugin: unauthenticated REST endpoint rewrites merchant credentials

The Wava Payment Plugin for WordPress, before 0.3.10, has a public REST endpoint with no authorisation, nonce or origin check. An unauthenticated attacker can overwrite the stored merchant credential, mark the integration as verified, and remove the payment method from checkout.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed version of the Wava Payment Plugin in the WordPress admin plugins list; it is affected if it is below `0.3.10`.
- Look for the plugin's REST routes under `/wp-json/` and confirm whether an unauthenticated request to them changes settings (unknown which exact route the sources name).

## Fix

- Update the Wava Payment Plugin to `0.3.10` or later.
- If you cannot update now, disable the plugin and rotate the merchant credential in the Wava account.

## Timeline

- 2026-10-23T21:57:28+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-87838
- 2026-10-24T13:15:54+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-87838

## From the sources

The Wava Payment Plugin WordPress plugin before 0.3.10 does not perform any authorisation, nonce or origin verification on one of its public REST endpoints, allowing unauthenticated attackers to overwrite the stored credential that identifies the merchant account the store's payments are created against, to force the integration into a verified state the site owner never completed, and to remove the payment method from the store's checkout.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_