PT-2026-22329 · WordPress+2 · Wordpress+3

Shohei Tanaka · Publicado 2026-02-27 · Atualizado 2026-02-27 · CVE-2026-1305

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Média

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions Japanized for WooCommerce plugin for WordPress versions up to and including 2.8.4

Description The software is susceptible to a flaw in authentication. A flawed permission check in the paidy webhook permission check function returns true when the webhook signature header is missing. This allows unauthenticated attackers to bypass payment verification and fraudulently mark orders as "Processing" or "Completed" by sending a crafted POST request to the Paidy API endpoint. The vulnerable API endpoint is the Paidy webhook endpoint. The paidy webhook permission check function is involved in the issue.

Recommendations Update Japanized for WooCommerce plugin for WordPress to a version later than 2.8.4.

Correção

Improper Authentication

Enumeração de Fraquezas

CWE-287

Identificadores relacionados

CVE-2026-1305

Produtos afetados

Japanized For Woocommerce

Paidy

Woocommerce

Wordpress

Referências · 11

• https://plugins.trac.wordpress.org/browser/woocommerce-for-japan/tags/2.8.2/includes/gateways/paidy/class-wc-paidy-endpoint.php#L108 · Nota
• https://plugins.trac.wordpress.org/changeset/3464868/woocommerce-for-japan/trunk/includes/gateways/paidy/class-wc-paidy-endpoint.php · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2026-1305 · Nota de Segurança
• https://wordfence.com/threat-intel/vulnerabilities/id/8cef4b2b-ae8d-4e18-b763-6960a0b944f7?source=cve · Nota
• https://plugins.trac.wordpress.org/browser/woocommerce-for-japan/trunk/includes/gateways/paidy/class-wc-paidy-endpoint.php#L108 · Nota
• https://t.me/CVEtracker/45969 · Publicação no Telegram
• https://t.me/cveNotify/153452 · Publicação no Telegram
• https://plugins.trac.wordpress.org/browser/woocommerce-for-japan/trunk/includes/gateways/paidy/class-wc-paidy-endpoint.php#L63 · Nota
• https://plugins.trac.wordpress.org/browser/woocommerce-for-japan/tags/2.8.2/includes/gateways/paidy/class-wc-paidy-endpoint.php#L63 · Nota
• https://twitter.com/CVEnew/status/2027380161662853312 · Publicação no Twitter
• https://twitter.com/VulmonFeeds/status/2027397912129368357 · Publicação no Twitter