Improper Authentication in Japanized for WooCommerce Plugin by WordPress

CVE-2026-1305

What is CVE-2026-1305?

The Japanized for WooCommerce plugin for WordPress suffers from an Improper Authentication vulnerability due to a deficient permission check in the paidy_webhook_permission_check function. This flaw allows unauthenticated attackers to bypass payment verification. Specifically, if the webhook signature header is omitted, the function unconditionally returns true, enabling unauthorized access. As a result, attackers can manipulate the order status, potentially marking orders as 'Processing' or 'Completed' without any genuine payment, leading to significant security risks for online merchants and their customers.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References