CVE-2026-1305: 
WordPress vulnerability analysis and mitigation

CVE-2026-1305 is an Improper Authentication vulnerability in the "Japanized for WooCommerce" WordPress plugin that allows unauthenticated attackers to bypass payment verification and fraudulently mark orders as "Processing" or "Completed" without actual payment. The flaw affects all versions up to and including 2.8.4. It was published on February 27, 2026, with the CVE assigned by Wordfence. The vulnerability carries a CVSS v3.1 base score of 5.3 (Medium) (Wordfence, ENISA EUVD).

The root cause is a flawed permission check in the paidy_webhook_permission_check function (CWE-287: Improper Authentication). Specifically, the function unconditionally returns true when the Paidy webhook signature header is absent from the incoming request, rather than rejecting unsigned requests. This means an attacker can send a crafted POST request to the Paidy webhook endpoint without any valid signature, and the plugin will treat it as a legitimate, authenticated webhook event. No prior authentication, account, or special privileges are required to exploit this flaw (Wordfence, WordPress Trac).

Successful exploitation allows unauthenticated attackers to fraudulently update WooCommerce order statuses to "Processing" or "Completed" without completing actual payment through the Paidy payment gateway. This directly impacts the integrity of e-commerce transactions, enabling order fraud and financial loss for merchants. There is no confidentiality or availability impact; the risk is confined to integrity of payment and order data on affected WordPress/WooCommerce stores (Wordfence, ENISA EUVD).

No public exploit code or active in-the-wild exploitation has been reported as of the available data. The EPSS score is approximately 0.228%, indicating a low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been identified (Feedly, ENISA EUVD).

1. Reconnaissance: Identify WordPress sites using the "Japanized for WooCommerce" plugin (version ≤ 2.8.4) with Paidy payment enabled, using tools like WPScan or by inspecting plugin directories.
2. Identify the webhook endpoint: Locate the Paidy webhook REST API endpoint registered by the plugin (typically a WooCommerce REST API route for Paidy webhook events).
3. Craft a POST request without signature header: Send a POST request to the Paidy webhook endpoint, deliberately omitting the webhook signature header. Because paidy_webhook_permission_check returns true when the header is absent, the request passes authentication.
4. Forge a payment completion event: Include a JSON payload in the POST body that mimics a legitimate Paidy payment completion event, specifying a target order ID and a status of "authorized" or "closed" (as expected by the plugin).
5. Order status updated: The plugin processes the forged webhook and updates the targeted WooCommerce order status to "Processing" or "Completed," allowing the attacker to receive goods or services without payment (Wordfence, WordPress Trac).

• Network: Unexpected POST requests to the Paidy webhook REST API endpoint (e.g., /wp-json/wc/v3/paidy/webhook or similar) originating from IP addresses not associated with Paidy's infrastructure; requests lacking the standard Paidy signature header.
• Logs: WordPress/WooCommerce access logs showing POST requests to the Paidy webhook endpoint with HTTP 200 responses from unknown or suspicious source IPs; absence of the X-Paidy-Signature (or equivalent) header in webhook request logs.
• Application: WooCommerce orders unexpectedly transitioning to "Processing" or "Completed" status for Paidy payment method without a corresponding confirmed payment record in the Paidy merchant dashboard; orders fulfilled without matching Paidy transaction IDs.

Administrators should update the "Japanized for WooCommerce" plugin to version 2.8.5 or later, which includes a fix in class-wc-paidy-endpoint.php (see changeset 3464868). The patch corrects the paidy_webhook_permission_check function to properly validate the webhook signature header and reject requests where it is absent. As an interim workaround, site administrators can disable the Paidy payment gateway within WooCommerce settings until the plugin is updated. Regularly auditing WooCommerce order status changes for anomalies is also recommended (Wordfence, WordPress Trac Changeset).

The vulnerability was reported and disclosed by Wordfence, which assigned the CVE and published the advisory. Coverage has been limited to automated vulnerability aggregators and security databases (VulnDB, Vulners, CIRCL, ENISA EUVD, INCIBE-CERT), with no notable independent researcher commentary or significant social media discussion identified beyond a brief mention on Bluesky (Wordfence, ENISA EUVD).