CVE-2026-87837: CWE-862 Missing Authorization in Wava Payment Plugin

CVE-2026-87837 is a missing authorization vulnerability (CWE-862) in the Wava Payment Plugin for WordPress. The plugin fails to verify the authenticity of incoming payment-provider notifications and does not restrict which entities may send these notifications. As a result, unauthenticated attackers can alter the status of any WooCommerce order in the affected store. Furthermore, in versions up to 0.3.7, the plugin discloses billing details such as customer names, addresses, email addresses, and phone numbers to unauthorized callers. The affected versions are from 0.3.1 up to but excluding 0.3.10.

An attacker can change order statuses without authentication, potentially marking unpaid orders as paid and completed or cancelling other customers' orders, disrupting business operations and causing financial and reputational damage. In versions up to 0.3.7, sensitive customer billing information is exposed to unauthenticated attackers, leading to privacy violations and potential data misuse.

No patch or official fix information is provided in the available data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the payment notification endpoint and monitor for unauthorized order status changes. Avoid using affected versions and consider upgrading once a fixed version is released.