The Wava Payment plugin for WordPress contains a missing authorization flaw that permits unauthenticated or improperly authenticated users to perform actions that should be restricted to privileged administrators. This broken access control can lead to data exposure, unauthorized configuration changes, or other compromises depending on the features exposed by the plugin.

The plugin is distributed by Wava.co under the name Wava Payment. Versions from the earliest released up through 0.3.7 are affected. Administrators should verify the version of the plugin installed on each WordPress site and treat any instance older than 0.4.0 as vulnerable.

The CVSS score is not publicly disclosed; EPSS is unavailable and the submission is not listed in the CISA KEV catalog, suggesting the risk is not currently prioritized. Nonetheless, the vulnerability allows an attacker who can reach the WordPress interface to bypass standard access controls. The attack vector is likely remote via web requests to the plugin's endpoints, and no elevated privileges are required beyond basic web access.