The Wava Payment Plugin for WordPress, versions 0.3.1 through 0.3.9, contains a missing authorization, nonce, and origin verification on a public REST endpoint that allows an unauthenticated attacker to overwrite the stored merchant credential. This can force the site into a verified merchant state that the owner never approved and can also remove the payment method from checkout, potentially leading to loss of revenue and unauthorized access to payment funds.

Affected systems include WordPress sites using the Wava Payment Plugin version 0.3.1 up to 0.3.9. The bug is fixed in 0.3.10 and newer releases. No other vendor or product is listed.

The CVSS score of 6.5 indicates a medium severity. The EPSS score of less than 1% suggests low probability of exploitation, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is any unauthenticated request to the vulnerable REST endpoint, meaning that any internet‑connected user can exploit it without authentication or privilege. Because the plugin performs no authorization checks, an attacker can persistently change merchant credentials and remove payment methods, thereby compromising the integrity and availability of the payment process on the affected site.