VulnSocial

CVE-2026-1305Disclosure

LOWCVSS 5.3 · MEDIUM

Signal is active with 2 mentions in latest observed window

Immediate actions

  • Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

The Japanized for WooCommerce plugin for WordPress is vulnerable to Improper Authentication in versions up to, and including, 2.8.4. This is due to a flawed permission check in the `paidy_webhook_permission_check` function that unconditionally returns `true` when the webhook signature header is omitted. This makes it possible for unauthenticated attackers to bypass payment verification and fraudulently mark orders as "Processing" or "Completed" without actual payment via a crafted POST request to the Paidy webhook endpoint.

Back to dashboard
0.0/ 10 priority

Sources & remediation

Other references
Weakness type (CWE)
CWE-287

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

NONE

Momentum

NONE

Threat summary

  • 2 mentions across 1 observed day

What's happening

  • Technical details provided in 2 signals
  • Disclosure: 2 classified signals
  • 2 total mentions across 1 day

Deep dive

Activity timeline2 mentions / 1d
01122Mentions · 2026-02-27: 2Technical Details · 2026-02-27: 202-27
Signal classification1 categories
Disclosure
2100.0%
Referenced assets3 URLs
Full discourse2 posts
  • Vulmon Vulnerability Feed@VulmonFeeds
    Disclosure

    CVE-2026-1305 Unauthenticated Payment Verification Bypass in Japanized for WooCo... https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-1305 Customizable Vulnerability Alerts: https://alerts.vulmon.com/?utm_source=twitter&utm_medium=social&utm_campaign=2102281&utm_content=4

    Post summary

    The tweet references CVE-2026-1305, an unauthenticated payment verification bypass in Japanized for WooCommerce, but provides no PoC, exploit code, or mitigation details.

    0000033
    4.0K followersView on X
  • CVE@CVEnew
    Disclosure

    CVE-2026-1305 The Japanized for WooCommerce plugin for WordPress is vulnerable to Improper Authentication in versions up to, and including, 2.8.4. This is due to a flawed permission … https://www.cve.org/CVERecord?id=CVE-2026-1305

    Post summary

    The post announces CVE-2026-1305, identifying an improper authentication flaw in the Japanized for WooCommerce plugin for WordPress, but offers no PoC, exploit code, patch, or evidence of active exploitation.

    0000071
    56.6K followersView on X

Explore more

Back to dashboard