CVE-2026-87837: Wava Payment Plugin 0.3.1 to before 0.3.10

Affected technology

Wava Payment Plugin · 0.3.1 to before 0.3.10
Vendor not specified by the source

Description’s affected range: before 0.3.10 does not verify the authenticity of incoming payment-provider notifications

Component: Not specified by the source

What an attacker can do

Unauthenticated attackers can change the status of any WooCommerce order in the store, including marking an unpaid order as paid and completed, and cancelling other customers' orders.