PT-2026-22329 · WordPress+2 · Wordpress+3

Shohei Tanaka · Published 2026-02-27 · Updated 2026-02-27 · CVE-2026-1305

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions Japanized for WooCommerce plugin for WordPress versions up to and including 2.8.4

Description The software is susceptible to a flaw in authentication. A flawed permission check in the paidy webhook permission check function returns true when the webhook signature header is missing. This allows unauthenticated attackers to bypass payment verification and fraudulently mark orders as "Processing" or "Completed" by sending a crafted POST request to the Paidy API endpoint. The vulnerable API endpoint is the Paidy webhook endpoint. The paidy webhook permission check function is involved in the issue.

Recommendations Update Japanized for WooCommerce plugin for WordPress to a version later than 2.8.4.

Fix

Improper Authentication

Weakness Enumeration

CWE-287

Related Identifiers

CVE-2026-1305

Affected Products

Japanized For Woocommerce

Paidy

Woocommerce

Wordpress

References · 11

• https://nvd.nist.gov/vuln/detail/CVE-2026-1305 · Security Note
• https://plugins.trac.wordpress.org/browser/woocommerce-for-japan/tags/2.8.2/includes/gateways/paidy/class-wc-paidy-endpoint.php#L108 · Note
• https://plugins.trac.wordpress.org/changeset/3464868/woocommerce-for-japan/trunk/includes/gateways/paidy/class-wc-paidy-endpoint.php · Note
• https://wordfence.com/threat-intel/vulnerabilities/id/8cef4b2b-ae8d-4e18-b763-6960a0b944f7?source=cve · Note
• https://plugins.trac.wordpress.org/browser/woocommerce-for-japan/trunk/includes/gateways/paidy/class-wc-paidy-endpoint.php#L108 · Note
• https://t.me/CVEtracker/45969 · Telegram Post
• https://t.me/cveNotify/153452 · Telegram Post
• https://plugins.trac.wordpress.org/browser/woocommerce-for-japan/trunk/includes/gateways/paidy/class-wc-paidy-endpoint.php#L63 · Note
• https://plugins.trac.wordpress.org/browser/woocommerce-for-japan/tags/2.8.2/includes/gateways/paidy/class-wc-paidy-endpoint.php#L63 · Note
• https://twitter.com/CVEnew/status/2027380161662853312 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2027397912129368357 · Twitter Post