Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2025-14886: Japanized for WooCommerce Plugin Exposes Orders to Unauthorized Changes

CVE-2025-14886 · published 9 months ago

Summary

The Japanized for WooCommerce plugin for WordPress has a security weakness that allows attackers to secretly change any order status without permission. This means that an attacker could mark an order as completed or processed without the merchant's knowledge or consent. To fix this, update the plugin to a version newer than 2.7.17.

Original advisory text

The Japanized for WooCommerce plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the `order` REST API endpoint in all versions up to, and including, 2.7.17. This makes it possible for unauthenticated attackers to mark any WooCommerce order as processed/completed.

References

Fix within

Internet-facing 14 days

Internal 60 days

Not known to be exploited
Can be exploited automatically
Gives an attacker partial control

Severity

5.3 Medium

Exploitation

<1% chance of attack within 30 days

Type

CWE-862Missing Authorization

Timeline

Published9 Jan 2026

Updated4 Nov 2026

First seen7 Mar 2026

Sources

CVE-2025-14886 · NVD

Track software like this

Free during beta