CVE-2026-39609

MediumCVSS 5.3

Published: 08/04/2026(UTC)Updated: 24/07/2026(UTC)Translated: 25/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.19%

9th percentile - higher than 9% of all known CVEs

Summary

The Wava Payment WordPress plugin has a missing authorization vulnerability, allowing exploitation of incorrectly configured access control security levels. This issue affects versions up to and including 0.3.7.

Risk Assessment

An unauthorized user can manipulate payment transactions or access sensitive financial data, potentially leading to financial loss.

Recommendation

Update the Wava Payment plugin to the latest version and verify access control configuration.

Original NVD description (English source)

Missing Authorization vulnerability in Wava.co Wava Payment wava-payment allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Wava Payment: from n/a through <= 0.3.7.