CVE-2026-87838

The Wava Payment Plugin for WordPress (versions before 0.3.10 ) is vulnerable to an unauthenticated merchant credential overwrite. The root cause is a lack of authorisation , nonce , or origin verification on one of its public REST endpoints . This allows an unauthenticated attacker to overwrite ...