CVE-2026-87838: CWE-862 Missing Authorization in Wava Payment Plugin

CVE-2026-87838 describes a missing authorization vulnerability (CWE-862) in the Wava Payment Plugin WordPress plugin before version 0.3.10. The plugin fails to perform any authorization, nonce, or origin verification on one of its public REST endpoints. This flaw enables unauthenticated attackers to overwrite the stored merchant account credentials, which identify the merchant account used for processing payments. Exploitation can force the payment integration into a verified state that the site owner never completed and can remove the payment method from the store's checkout process.

An attacker can manipulate the merchant account credentials without authentication, potentially disrupting payment processing by forcing an unauthorized verified state or removing the payment method from the checkout. This could lead to payment failures or unauthorized payment configurations, impacting the store's ability to process legitimate transactions.

Upgrade the Wava Payment Plugin to version 0.3.10 or later where this authorization issue is fixed. Since the plugin versions before 0.3.10 are vulnerable, applying the official update is the recommended remediation. No vendor advisory content is provided, so patch status is inferred from the version range; verify with the vendor for confirmation.