The WWDR certificate, short for Apple Worldwide Developer Relations, is the intermediate link in the chain of trust behind every Apple Wallet pass. Apple's root certificate vouches for WWDR, WWDR vouches for each issuer's pass signing certificate, and that certificate signs the pass. When an iPhone checks a pkpass before adding it, this is the chain it walks; if any link fails, the pass is refused with a generic download error.
Signing a pass therefore takes three pieces: the Pass Type ID certificate for the program, its private key, usually held together as a PKCS #12 bundle, and the WWDR intermediate included alongside the signature so devices can complete the chain. All three are ordinary X.509 certificates; WWDR is simply the one Apple publishes for everyone rather than issuing per program.
The operational catch is generations. Apple periodically retires a WWDR certificate and issues the next one, G4 being the current generation for pass signing, and a pipeline still bundling a retired generation produces passes that no device will add, with nothing else changed. "Signing worked last month and fails today" is very often this, which is why the WWDR generation is the first thing to check when valid-looking passes stop adding.
For merchants on a managed platform, WWDR is below the waterline: the platform bundles the right intermediate and tracks generation changes as routine maintenance. The term matters mainly when reading Apple's documentation or diagnosing a homegrown signing setup, where it is the least visible dependency and the most common surprise.