PT-2026-1756 · WordPress+1 · Japanized For Woocommerce+1

Published 2026-01-09 · Updated 2026-01-09 · CVE-2025-14886

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions Japanized for WooCommerce versions up to and including 2.7.17

Description The Japanized for WooCommerce plugin for WordPress is susceptible to unauthorized data modification. A missing capability check on the order REST API endpoint allows unauthenticated attackers to modify the status of any WooCommerce order, potentially marking it as processed or completed. The vulnerable API endpoint is /order. The order resource is affected, allowing modification without proper authorization.

Recommendations Versions prior to and including 2.7.17 should be updated.

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2025-14886

Affected Products

Japanized For Woocommerce

Woocommerce

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2025-14886 · Security Note
• https://wordfence.com/threat-intel/vulnerabilities/id/4bf3248a-f235-472c-b751-96ac9838b27f?source=cve · Note
• https://twitter.com/VulmonFeeds/status/2009505773659828328 · Twitter Post
• https://plugins.trac.wordpress.org/browser/woocommerce-for-japan/tags/2.7.17/includes/gateways/paidy/class-wc-paidy-endpoint.php#L51 · Note
• https://twitter.com/CVEnew/status/2009512193939935671 · Twitter Post
• https://t.me/cveNotify/148175 · Telegram Post
• https://t.me/CVEtracker/41793 · Telegram Post