CVE-2026-39609

CVE-2026-39609 is a missing authorization vulnerability in Wava Payment versions 0.3.7 and earlier that stems from incorrectly configured access control security levels. This flaw permits unauthorized access to protected resources without requiring proper authentication or authorization checks. The vulnerability is specific to Wava.co's payment processing plugin and could allow attackers to gain unauthorized information access. The vulnerability carries a CVSS severity rating of 5.3 (Medium) with a network-based attack vector requiring no authentication, low complexity, and no user interaction. While the attack is relatively easy to execute remotely, the impact is limited to confidentiality breaches with no integrity or availability impact. The FAUCET risk score of 32.0 out of 100 indicates moderate concern within the organizational context. There is currently no evidence of active exploitation in the wild. The vulnerability does not appear on the CISA Known Exploited Vulnerabilities list and remains inactive on threat tracking lists. The extremely low EPSS score of 0.00037 suggests minimal real-world exploitation probability, though organizations running affected Wava Payment versions should still prioritize patching to versions beyond 0.3.7 to close this authorization gap.