Japanized For WooCommerce, CVE-2025-14886

CVE, Research URL: CVE-2025-14886
Home page URL: Security reports for Japanized For WooCommerce
Application: Japanized For WooCommerce
Published on: Jan 09, 2026
Research Description: The Japanized for WooCommerce plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the `order` REST API endpoint in all versions up to, and including, 2.7.17. This makes it possible for unauthenticated attackers to mark any WooCommerce order as processed/completed.
Affected versions: max 2.8.0.
Status: vulnerable