CVE-2026-87837
Deferred Deferred - Pending Action

Authentication Bypass in Wava Payment Plugin for WooCommerce

Publication date: 2026-10-21

Last updated on: 2026-10-21

Assigner: WPScan

Description
The Wava Payment Plugin WordPress plugin before 0.3.10 does not verify the authenticity of incoming payment-provider notifications, nor restrict who may send them, allowing unauthenticated attackers to change the status of any WooCommerce order in the store, including marking an unpaid order as paid and completed, and cancelling other customers' orders. In versions up to 0.3.7 the response additionally returns the affected order's billing details, disclosing customer names, addresses, email addresses and phone numbers to the same unauthenticated caller.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-21
Last Modified
2026-10-21
Generated
2026-11-10
AI Q&A
2026-10-21
EPSS Evaluated
2026-11-09
NVD
CVE-2026-87837
EUVD
EUVD-2026-107086

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
Unknown Wava Payment Plugin 0.3.1

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-862 The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects the Wava Payment Plugin for WordPress. It allows unauthenticated attackers to change the status of any WooCommerce order without verification. Attackers can mark unpaid orders as paid or completed and cancel orders belonging to other customers. In versions up to 0.3.7, the flaw also exposes sensitive customer billing details like names, addresses, emails, and phone numbers to attackers.

Detection Guidance

Check if the Wava Payment Plugin is installed and its version. If it is version 0.3.9 or below, the system is vulnerable. Look for unauthorized order status changes or exposed billing details in logs.

Impact Analysis

If you use the affected Wava Payment Plugin versions, attackers could manipulate your store's orders, leading to financial losses or incorrect order statuses. Customer data may also be exposed, risking privacy breaches and potential misuse of personal information.

Compliance Impact

This vulnerability could lead to non-compliance with GDPR due to unauthorized exposure of customer data. HIPAA compliance may also be affected if customer billing details include protected health information. Organizations must address this flaw to avoid legal and regulatory penalties.

Mitigation Strategies

Update the Wava Payment Plugin to version 0.3.10 or later immediately. If updating is not possible, disable the plugin until an update is applied.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-87837. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...