The Japanized for WooCommerce plugin contains an improper authentication flaw whereby the function handling the Paidy webhook bypasses permission checks when the signature header is absented. This flaw allows an unauthenticated user to send a crafted HTTP POST request to the webhook endpoint and alter an order’s status to Processing or Completed without actual payment. The resulting compromise is a fraud scenario in which goods or services are released to a non‑paying party, directly impacting the merchant’s financial integrity. The attack is conducted from outside the site; the attacker only requires network access to the webhook URL and knowledge of the order ID and desired status. The flaw is a classic example of CWE‑287, Improper Authentication.

The vulnerability affects the WordPress plugin "Japanized for WooCommerce" by shoheitanaka, versions up to and including 2.8.4. All installations running these or older releases are susceptible, regardless of the WooCommerce version. No other products are listed as impacted.

The CVSS score of 5.3 indicates a medium severity, and the EPSS value of <1% reflects a low current exploitation probability. The vulnerability is not listed in the CISA KEV catalog, suggesting that no widespread, actively observed exploitation has been reported. Nevertheless, the flaw provides a direct path to fraud without requiring any privileged credentials or additional system access. An attacker who can reach the webhook endpoint can change order status in real‑time, potentially causing immediate financial loss and reputational damage.