Japanized for WooCommerce <= 2.8.4 - 缺少身份验证导致未经授权的Paidy订单篡改

The primary impact of CVE-2026-1305 is the potential for fraudulent order processing. An attacker can craft a malicious POST request to the Paidy webhook endpoint, bypassing the payment verification process. This allows them to mark orders as "Processing" or "Completed" without any actual payment being received. This can result in significant financial losses for merchants and damage to their reputation. The lack of authentication means that any attacker with network access to the WordPress site can potentially exploit this vulnerability, increasing the overall blast radius.

WordPress sites utilizing the Japanized for WooCommerce plugin, particularly those integrated with Paidy for payment processing, are at risk. Shared hosting environments where plugin updates are managed centrally are also at increased risk, as they may be slower to apply security patches.

• wordpress / composer / npm:

grep -r 'paidy_webhook_permission_check' /var/www/html/wp-content/plugins/japanized-for-woocommerce/

• generic web:

curl -I https://your-wordpress-site.com/wp-content/plugins/japanized-for-woocommerce/ | grep -i 'signature'

1. 2026-02-27Disclosure

   disclosure

1. 已保留2026-01-21
2. 发布日期2026-02-27
3. 修改日期2026-04-08
4. EPSS 更新日期2026-03-23

The primary mitigation for CVE-2026-1305 is to immediately upgrade the Japanized for WooCommerce plugin to version 2.8.5 or later. If upgrading is not immediately feasible, consider implementing a Web Application Firewall (WAF) rule to block requests to the Paidy webhook endpoint that lack the expected signature header. Additionally, review and strengthen the Paidy webhook implementation to ensure robust authentication checks are in place. After upgrading, verify the fix by attempting to manually trigger the webhook with a missing signature header to confirm that the authentication check is now enforced.

活跃安装数

10K已知

插件评分