What the vulnerability does
01Description
The Japanized for WooCommerce plugin for WordPress is vulnerable to Improper Authentication in versions up to, and including, 2.8.4. This is due to a flawed permission check in the `paidy_webhook_permission_check` function that unconditionally returns `true` when the webhook signature header is omitted. This makes it possible for unauthenticated attackers to bypass payment verification and fraudulently mark orders as "Processing" or "Completed" without actual payment via a crafted POST request to the Paidy webhook endpoint.
Explanation of Vulnerability in Simple Terms
02Summary
Japanized for WooCommerce versions 2.8.4 and earlier contain an authentication flaw that allows attackers to modify data without proper verification. The vulnerability requires no user interaction and can be exploited over the network. Site administrators should update to a version newer than 2.8.4 to resolve this issue.
What an attacker can do
03Attacker Capabilities
Modify site data without proper authentication verification.
Potential impact on your site
04Site Impact
Attackers can alter WooCommerce data (orders, products, settings) without logging in.
Conditions required to exploit
05Prerequisites
Network access to the site; no authentication or user interaction required.
Key dates
06Disclosure timeline
February 27, 2026
CVE published
April 8, 2026
Record updated
