Wava Payment Plugin CVE-2026-87838

Requires the Wava Payment Plugin to be installed and active at a version in the range 0.3.1 up to (but not including) 0.3.10, with the affected public REST endpoint reachable - which it is in default configuration since the endpoint performs no authorisation, nonce, or origin verification. No special configuration, authentication, or user interaction is needed: this is remote unauthenticated exploitation against default installations. The only meaningful limiting factors are that the site must run the vulnerable plugin version and the merchant payment integration must be in use for the credential-overwrite and checkout-removal impact to be meaningful.

This is a moderate-risk, genuinely actionable flaw rather than a high-CVSS paper tiger, but its blast radius is bounded. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) confirms remote, unauthenticated, low-complexity exploitation with no user interaction - the worst-case access profile - and this is corroborated by the description's explicit statement that the REST endpoint performs no authorisation, nonce, or origin verification (CWE-862). A public exploit exists (reported/published by WPScan), which materially raises likelihood versus a theoretical issue, but there is NO CISA KEV listing and NO EPSS score was provided in the input, so there is no evidence of active, widespread exploitation at this time. Signals are therefore consistent, not conflicting: easy to exploit and POC-backed, but impact is scoped (C:N/I:L/A:L, scope unchanged) - attackers cannot read data or achieve code execution, only tamper with payment-integration state and disrupt checkout. The practical business risk (payment redirection to an attacker-controlled merchant account and loss of the checkout payment method) can be severe financially even though the CVSS numeric impact is 'Low'; defenders should weight the business context, not just the 6.5 score. EPSS is MISSING from the provided data and cannot be used to refine likelihood.

An unauthenticated attacker sends a single crafted HTTP request to the plugin's public REST endpoint, which performs no authorisation or nonce check, overwriting the stored merchant-account credential so future payments are created against an account the attacker controls and flipping the integration into a 'verified' state the owner never completed. The same unauthenticated access can instead remove the payment method from checkout, denying customers the ability to pay. A public exploit is already available (reported by WPScan), so weaponisation requires little effort beyond locating a vulnerable site.