The Wava Payment Plugin for WordPress, before version 0.3.10, lacks authentication verification for incoming payment-provider notifications and does not restrict which sources can send them. This flaw, identified as missing authentication (CWE-862), allows an attacker to change the status of any WooCommerce order, marking unpaid orders as paid and completed or cancelling other customers’ orders. Earlier releases up to 0.3.7 also returned the affected order’s billing details—including customer names, addresses, email addresses, and phone numbers—to unauthenticated callers, exposing sensitive personal information. The resulting breach of integrity and confidentiality can facilitate fraud, revenue loss, and compliance violations.

The vulnerability affects the Wava Payment Plugin for WordPress, specifically versions 0.3.1 through 0.3.9. Versions up to 0.3.7 additionally expose billing information through the unsecured webhook response.

The CVSS score is 5.3, indicating moderate severity, while the EPSS score is less than 1%, showing a low probability of exploitation in the wild. The issue is not listed in the CISA KEV catalog. Because the webhook endpoint accepts requests without authentication, an attacker can simply send crafted HTTP requests or forge callbacks from any source. In practice, this enables unauthorized reclassification of order states or cancellation without access to the store’s administrative controls, and in earlier releases it also exposes personally identifiable information. Given the lack of authentication and the potential financial impact, the risk warrants proactive remediation.