The vulnerability in the Wava Payment WordPress plugin consists of a missing authorization check, allowing attackers to access protected resources or perform privileged actions without proper authentication. The weakness falls under CWE‑862 and can lead to data exposure, configuration manipulation, or further compromise of the impacted WordPress site. This breach of confidentiality and integrity arises because the plugin fails to enforce its designated access control levels, thereby granting unintended privileges to unauthenticated or low‑privileged users.

The affected product is the Wava Payment plugin developed by Wava.co for WordPress. All installations using version 0.3.7 or earlier are vulnerable. This includes any WordPress deployment that has loaded the plugin up to the specified version and has not applied security patches or upgraded beyond it.

The CVSS base score of 5.3 indicates a moderate severity. The EPSS score is below 1%, suggesting a currently low likelihood of exploitation, and the issue is not listed in the CISA KEV catalog. Exploitation is achievable remotely through the plugin’s web interface, as the missing authorization controls can be triggered by accessible URLs or malformed requests. Attackers do not require specific privileges to begin exploitation; once the vector is identified, they can gain unintended access to plugin data or configuration settings.