CVE-2026-1305

Description

The Japanized for WooCommerce plugin for WordPress is vulnerable to Improper Authentication in versions up to, and including, 2.8.4. This is due to a flawed permission check in the `paidy_webhook_permission_check` function that unconditionally returns `true` when the webhook signature header is omitted. This makes it possible for unauthenticated attackers to bypass payment verification and fraudulently mark orders as "Processing" or "Completed" without actual payment via a crafted POST request to the Paidy webhook endpoint.

PUBLISHED Reserved 2026-01-21 | Published 2026-02-27 | Updated 2026-02-27 | Assigner Wordfence

Problem types

CWE-287 Improper Authentication

Product status

Timeline

Credits

Osvaldo Noe Gonzalez Del Rio finder

References

www.wordfence.com/...-ae8d-4e18-b763-6960a0b944f7?source=cve

plugins.trac.wordpress.org/...dy/class-wc-paidy-endpoint.php

plugins.trac.wordpress.org/...dy/class-wc-paidy-endpoint.php

plugins.trac.wordpress.org/...dy/class-wc-paidy-endpoint.php

plugins.trac.wordpress.org/...dy/class-wc-paidy-endpoint.php

plugins.trac.wordpress.org/...dy/class-wc-paidy-endpoint.php

cve.org (CVE-2026-1305)

nvd.nist.gov (CVE-2026-1305)

Download JSON