CVE-2026-87838: Wava Payment Plugin 0.3.1 to before 0.3.10

Affected technology

Wava Payment Plugin · 0.3.1 to before 0.3.10
Vendor not specified by the source

Description’s affected range: before 0.3.10 does not perform any authorisation

Component: Not specified by the source

What an attacker can do

Unauthenticated attackers can overwrite the stored credential that identifies the merchant account the store's payments are created against, to force the integration into a verified state the site owner never completed, and to remove the payment method from the store's checkout.