CVE-2026-1305: Shoheitanaka Japanized For Woocommerce

Medium severity, CVSS 5.3. EPSS: 0.4% chance of exploitation in the next 30 days.

The Japanized for WooCommerce plugin for WordPress is vulnerable to Improper Authentication in versions up to, and including, 2.8.4. This is due to a flawed permission check in the `paidy_webhook_permission_check` function that unconditionally returns `true` when the webhook signature header is omitted. This makes it possible for unauthenticated attackers to bypass payment verification and fraudulently mark orders as "Processing" or "Completed" without actual payment via a crafted POST request to the Paidy webhook endpoint.

Affected products

• Shoheitanaka Japanized For Woocommerce: up to and including 2.8.4

Published 2026-02-27. Last modified 2026-06-17.