Improper Authentication in Japanized for WooCommerce Plugin by WordPress

CVE-2026-1305

What is CVE-2026-1305?

The Japanized for WooCommerce plugin for WordPress suffers from an Improper Authentication vulnerability due to a deficient permission check in the paidy_webhook_permission_check function. This flaw allows unauthenticated attackers to bypass payment verification. Specifically, if the webhook signature header is omitted, the function unconditionally returns true, enabling unauthorized access. As a result, attackers can manipulate the order status, potentially marking orders as 'Processing' or 'Completed' without any genuine payment, leading to significant security risks for online merchants and their customers.

References