Wava Payment Plugin
Monthly
Unauthenticated attackers can rewrite the merchant credential that a WordPress store's Wava Payment Plugin uses to create payments, silently flip the integration into a 'verified' state the site owner never completed, and strip the payment method from checkout entirely. The flaw affects versions 0.3.1 through 0.3.9 (fixed in 0.3.10) and is reachable in default configuration because the exposed public REST endpoint enforces no authorisation, nonce, or origin check. Ratings put it at CVSS 6.5 (AV:N/AC:L/PR:N/UI:N, integrity and availability only), and publicly available exploit code exists, so mass scanning against WordPress REST paths is plausible even though there is no confirmed active exploitation (no CISA KEV listing).
Unauthenticated order manipulation in the Wava Payment Plugin for WordPress (0.3.1 through 0.3.9) allows remote attackers to forge payment-provider notifications and change WooCommerce order states, including marking unpaid orders paid and completed and cancelling other customers' orders. Versions through 0.3.7 also return billing details such as names, addresses, emails, and phone numbers to the same unauthenticated caller. Publicly available exploit code exists, and the vendor has released 0.3.10 to address the missing authorization and authenticity checks.
Unauthenticated attackers can rewrite the merchant credential that a WordPress store's Wava Payment Plugin uses to create payments, silently flip the integration into a 'verified' state the site owner never completed, and strip the payment method from checkout entirely. The flaw affects versions 0.3.1 through 0.3.9 (fixed in 0.3.10) and is reachable in default configuration because the exposed public REST endpoint enforces no authorisation, nonce, or origin check. Ratings put it at CVSS 6.5 (AV:N/AC:L/PR:N/UI:N, integrity and availability only), and publicly available exploit code exists, so mass scanning against WordPress REST paths is plausible even though there is no confirmed active exploitation (no CISA KEV listing).
Unauthenticated order manipulation in the Wava Payment Plugin for WordPress (0.3.1 through 0.3.9) allows remote attackers to forge payment-provider notifications and change WooCommerce order states, including marking unpaid orders paid and completed and cancelling other customers' orders. Versions through 0.3.7 also return billing details such as names, addresses, emails, and phone numbers to the same unauthenticated caller. Publicly available exploit code exists, and the vendor has released 0.3.10 to address the missing authorization and authenticity checks.