CVE-2025-14886
Unauthorized Data Modification in Japanized WooCommerce via REST API
Publication date: 2026-01-09
Last updated on: 2026-01-09
Assigner: Wordfence
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| unknown_vendor | woocommerce_for_japan | to 2.7.17 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-862 | The product does not perform an authorization check when an actor attempts to access a resource or perform an action. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability exists in the Japanized for WooCommerce plugin for WordPress (up to version 2.7.17) where the `order` REST API endpoint lacks a proper capability check. This means unauthenticated attackers can access this endpoint and modify order data, specifically allowing them to mark any WooCommerce order as processed or completed without authorization. [1]
How can this vulnerability impact me? :
The vulnerability allows unauthenticated attackers to mark any WooCommerce order as processed or completed. This can lead to unauthorized order status changes, potentially causing financial discrepancies, fulfillment errors, and loss of control over order management in your WooCommerce store. [1]
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by monitoring for unauthorized POST requests to the REST API endpoint `/wp-json/paidy/v1/order` on your WooCommerce for Japan plugin installation. Since the endpoint allows unauthenticated access and modifies order statuses, suspicious or unexpected POST requests to this endpoint could indicate exploitation attempts. You can use network monitoring tools or command-line utilities like curl or wget to test access. For example, to check if the endpoint is accessible without authentication, you can run: `curl -X POST https://yourdomain.com/wp-json/paidy/v1/order -d '{}' -v`. Additionally, inspecting web server logs for POST requests to `/wp-json/paidy/v1/order` from unknown or suspicious IP addresses can help detect exploitation attempts. [1]
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps include updating the Japanized for WooCommerce plugin to a version later than 2.7.17 where the missing capability check on the `order` REST API endpoint is fixed. If an update is not immediately available, restrict access to the `/wp-json/paidy/v1/order` endpoint by implementing authentication or IP whitelisting at the web server or application firewall level to prevent unauthenticated attackers from modifying order statuses. Additionally, monitor order status changes for suspicious activity and review logs for unauthorized access attempts. [1]