The Japanized For WooCommerce plugin contains an unauthenticated broken access control flaw. Attackers can request the plugin’s administrative interfaces without providing credentials, allowing them to modify WooCommerce settings such as shipping options, payment gateways, or pricing rules. This can lead to service disruption, financial loss, or unauthorized data exposure at the shop level.

All installations of the WordPress Japanized For WooCommerce plugin 2.9.12 or earlier are vulnerable. The flaw exists in the plugin’s exposed admin endpoints that do not verify user authentication before rendering configuration pages.

With a CVSS score of 6.5 the vulnerability represents a moderate risk. No current exploit code is known and the EPSS score is not available, but because the issue is unauthenticated it can be leveraged by any visitor to the site. The vulnerability is not listed in CISA’s KEV catalog, suggesting no publicly known exploitation at this time. However, the lack of authentication control makes discovery and exploitation straightforward for an attacker who can simply make HTTP requests to the admin URLs.