diff --git a/changelog/unreleased/kong/wasm-attach.yml b/changelog/unreleased/kong/wasm-attach.yml
new file mode 100644
index 000000000000..99ae358d4018
--- /dev/null
+++ b/changelog/unreleased/kong/wasm-attach.yml
@@ -0,0 +1,5 @@
+message: >
+  **proxy-wasm**: Fixed "previous plan already attached" error thrown when a
+  filter triggers re-entrancy of the access handler.
+type: bugfix
+scope: Core
diff --git a/kong/runloop/wasm.lua b/kong/runloop/wasm.lua
index 64502ca6b084..26ce3a9d9077 100644
--- a/kong/runloop/wasm.lua
+++ b/kong/runloop/wasm.lua
@@ -668,14 +668,19 @@ function _M.attach(ctx)
 
   ctx.ran_wasm = true
 
-  local ok, err = proxy_wasm.attach(chain.c_plan)
-  if not ok then
-    log(CRIT, "failed attaching ", chain.label, " filter chain to request: ", err)
-    return kong.response.error(500)
-  end
+  local ok, err
+  if not ctx.wasm_attached then
+    ctx.wasm_attached = true
+
+    ok, err = proxy_wasm.attach(chain.c_plan)
+    if not ok then
+      log(CRIT, "failed attaching ", chain.label, " filter chain to request: ", err)
+      return kong.response.error(500)
+    end
 
-  set_proxy_wasm_property("kong.route_id", ctx.route and ctx.route.id)
-  set_proxy_wasm_property("kong.service_id", ctx.service and ctx.service.id)
+    set_proxy_wasm_property("kong.route_id", ctx.route and ctx.route.id)
+    set_proxy_wasm_property("kong.service_id", ctx.service and ctx.service.id)
+  end
 
   ok, err = proxy_wasm.start()
   if not ok then