CVE-2025-14886

Name of the Vulnerable Software and Affected Versions Japanized for WooCommerce versions up to and including 2.7.17

Description The Japanized for WooCommerce plugin for WordPress is susceptible to unauthorized data modification. A missing capability check on the order REST API endpoint allows unauthenticated attackers to modify the status of any WooCommerce order, potentially marking it as processed or completed. The vulnerable API endpoint is /order. The order resource is affected, allowing modification without proper authorization.

Recommendations Versions prior to and including 2.7.17 should be updated.