Wava Payment Plugin
Approved changes feed: RSS · Atom
cpe:2.3:a:unknown:wava_payment_plugin:*:*:*:*:*:*:*:*part: a version: * update: *
| Vendor | Unknown (668ca391-a6cc-5e33-879b-83885214de33) |
|---|---|
| Product | Wava Payment Plugin (a9ec904a-6fe9-5097-a5d2-6196298df938) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
Notes
Imported from gcve-enriched-dumps CVE data
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2026-87838 |
vulnerable | 2026-11-03 10:16:09.119772 |
Wava Payment 0.3.1 - 0.3.9 - Unauthenticated Merchant Credential Overwrite via Install Webhook
The Wava Payment Plugin WordPress plugin before 0.3.10 does not perform any authorisation, nonce or origin verification on one of its public REST endpoints, allowing unauthenticated attackers to overwrite the stored credential that identifies the merchant account the store's payments are created against, to force the integration into a verified state the site owner never completed, and to remove the payment method from the store's checkout.
Published: 2026-10-21T06:00:25.381Z
Updated: 2026-10-21T10:35:01.578Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-87837 |
vulnerable | 2026-11-03 10:16:08.448024 |
Wava Payment 0.3.1 - 0.3.9 - Unauthenticated Order Status Change via Payment Webhook
The Wava Payment Plugin WordPress plugin before 0.3.10 does not verify the authenticity of incoming payment-provider notifications, nor restrict who may send them, allowing unauthenticated attackers to change the status of any WooCommerce order in the store, including marking an unpaid order as paid and completed, and cancelling other customers' orders.
In versions up to 0.3.7 the response additionally returns the affected order's billing details, disclosing customer names, addresses, email addresses and phone numbers to the same unauthenticated caller.
Published: 2026-10-21T06:00:25.208Z
Updated: 2026-10-21T10:35:01.724Z |
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.
Inspect record JSON
Open this panel to browse, search, copy or download the JSON record.