CVE-2026-1305

The Japanized for WooCommerce plugin for WordPress is vulnerable to Improper Authentication in versions up to, and including, 2.8.4. This is due to a flawed permission check in the `paidy_webhook_permission_check` function that unconditionally returns `true` when the webhook signature header is omitted. This makes it possible for unauthenticated attackers to bypass payment verification and fraudulently mark orders as "Processing" or "Completed" without actual payment via a crafted POST request to the Paidy webhook endpoint.

• CWE-287

• https://plugins.trac.wordpress.org/browser/woocommerce-for-japan/tags/2.8.2/includes/gateways/paidy/class-wc-paidy-endpoint.php#L108
• https://plugins.trac.wordpress.org/browser/woocommerce-for-japan/tags/2.8.2/includes/gateways/paidy/class-wc-paidy-endpoint.php#L63
• https://plugins.trac.wordpress.org/browser/woocommerce-for-japan/trunk/includes/gateways/paidy/class-wc-paidy-endpoint.php#L108
• https://plugins.trac.wordpress.org/browser/woocommerce-for-japan/trunk/includes/gateways/paidy/class-wc-paidy-endpoint.php#L63
• https://plugins.trac.wordpress.org/changeset/3464868/woocommerce-for-japan/trunk/includes/gateways/paidy/class-wc-paidy-endpoint.php
• https://www.wordfence.com/threat-intel/vulnerabilities/id/8cef4b2b-ae8d-4e18-b763-6960a0b944f7?source=cve

Published

Feb 27, 2026

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-13037Use after free in WebView in Google Chrome on Android prior …7.8
• CVE-2026-13038Use after free in Autofill in Google Chrome on Windows prior…8.8
• CVE-2026-13039The Eventin – Event Calendar, Event Registration, Tickets & …5.3
• CVE-2026-1304The Membership Plugin – Restrict Content for WordPress is vu…4.4
• CVE-2026-13040The NEX-Forms – Ultimate Forms Plugin for WordPress plugin f…7.2
• CVE-2026-13042The RPB Chessboard plugin for WordPress is vulnerable to Sto…7.2
• CVE-2026-13050An Out-of-bounds Write vulnerability in WatchGuard Fireware …8.6
• CVE-2026-13053An Out-of-bounds Write vulnerability in WatchGuard Fireware …7.2
• CVE-2026-13054A path traversal vulnerability in the WatchGuard Fireware OS…7.2
• CVE-2026-13055The `$_internalIndexKey` aggregation expression can be used …7.1
• CVE-2026-13056Using expressions that generate large arrays it is possible …7.1
• CVE-2026-13057An issue in the server’s Atlas Search integration allows an …6.5