Wava Payment Plugin CVE-2026-87837

The target store must have the Wava Payment Plugin (version 0.3.1 up to but not including 0.3.10) installed and active alongside WooCommerce. Exploitation requires sending a crafted HTTP request to the plugin's payment-provider notification/callback endpoint; because the plugin neither verifies notification authenticity nor restricts the sender, no authentication, token, or valid provider signature is needed and default configurations are vulnerable. The customer-billing-data disclosure is additionally limited to versions up to 0.3.7 (fixed-but-still-vulnerable 0.3.8/0.3.9 retain only the order-tampering issue). Practical limits: the attacker generally needs to reference valid WooCommerce order IDs (typically sequential/enumerable) to target specific orders, and the store must expose the plugin endpoint to the internet.

This is a genuine but moderate-priority issue whose signals mostly align. The provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) describes the easiest possible exploitation profile - remote, unauthenticated, low-complexity, no user interaction - which is fully consistent with the description of an unauthenticated attacker forging payment-provider notifications. The base score of 5.3 is held down to MEDIUM only because the vendor/NVD vector scores confidentiality as C:N and captures just a single I:L integrity impact. However, the description explicitly states that versions up to 0.3.7 also leak customer names, addresses, emails and phone numbers to the unauthenticated caller, so the published vector appears to UNDERSTATE real impact for that version range - confidentiality should arguably be C:L, raising the true severity. POC/exploit code is publicly available (WPScan), so weaponization barrier is low, but there is NO CISA KEV listing and NO EPSS score was provided, so there is no evidence of active or widespread exploitation and no probabilistic exploitation estimate to weigh. No SSVC decision data (exploitation status, automatable, technical impact) was supplied. Net: a readily exploitable, publicly-documented authorization flaw with direct financial-fraud consequences (free goods via fake 'paid' status) and order-cancellation sabotage, but real-world blast radius is constrained by the apparently niche deployment of this specific plugin.

An attacker identifies an online store running the Wava Payment Plugin and sends a forged payment-provider notification directly to the plugin's unauthenticated callback endpoint, marking their own unpaid WooCommerce order as 'paid/completed' to receive goods or services for free. Against stores on version 0.3.7 or earlier, the same forged request returns the target order's billing details, letting the attacker harvest other customers' names, addresses, emails and phone numbers. Public exploit details are available via the WPScan advisory, lowering the skill required.