Wava Payment Plugin Vulnerability Allows Order Manipulation and Data Exposure
CVE-2026-87837
Key Information:
- Vendor
WordPress
- Status
- Vendor
- CVE Published:
- 21 October 2026
Badges
What is CVE-2026-87837?
The Wava Payment Plugin for WordPress prior to version 0.3.10 fails to authenticate notifications received from payment providers, allowing unauthorized individuals to manipulate WooCommerce order statuses. This includes the potential to mark an unpaid order as paid or to cancel existing customers' orders. Additionally, earlier versions (up to 0.3.7) expose sensitive customer information such as names, addresses, emails, and phone numbers to any unauthenticated requester, significantly increasing the risk to customer privacy.
Affected Version(s)
Wava Payment Plugin 0.3.1 < 0.3.10
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.