Skip to content
CVE PROGRAM SOURCE RECORD5.3 Medium

CVE-2025-14886

Japanized for WooCommerce <= 2.7.17 - Missing Authorization to Unauthenticated Order Status Modification

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
Wordfence

Description

The Japanized for WooCommerce plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the `order` REST API endpoint in all versions up to, and including, 2.7.17. This makes it possible for unauthenticated attackers to mark any WooCommerce order as processed/completed.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

shoheitanaka Japanized for WooCommerce

Default version status: unaffected

  • 0 to ≤ 2.7.17affected

References