Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

2 records

Release: Wava Payment Plugin 0.3.10 Clear all filters
TI-2026-78575 CVE-2026-87838 · GHSA-hqf7-665r-7343

Missing authorization in Wava Payment Plugin for WordPress

Priority LOW 35

The Wava Payment Plugin WordPress plugin before 0.3.10 does not perform any authorisation, nonce or origin verification on one of its public REST endpoints, allowing unauthenticated attackers to overwrite the stored cred…

CVSS 3.1MEDIUM 6.5 Network No auth No interaction EPSS 0.00275 Published 2026-10-21 Fixed in 0.3.10 CWE-862
TI-2026-78574 CVE-2026-87837 · GHSA-8mpv-23rw-jfjx

Missing authorization in Wava Payment Plugin webhook

Priority LOW 30

The Wava Payment Plugin WordPress plugin before 0.3.10 does not verify the authenticity of incoming payment-provider notifications, nor restrict who may send them, allowing unauthenticated attackers to change the status…

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00247 Published 2026-10-21 Fixed in 0.3.10 CWE-862