The Japanized for WooCommerce plugin suffers from a missing capability check (CWE-862) on its order REST API endpoint in all versions up to 2.7.17. This flaw enables unauthenticated users to change the status of WooCommerce orders to processed or completed, bypassing normal authorization controls. The CVSS 3.1 base score is 5.3 (medium), reflecting network attack vector, low complexity, no privileges required, no user interaction, unchanged scope, no confidentiality or availability impact, but low integrity impact. No patch or vendor advisory is currently available, and no known exploits are reported in the wild.

An attacker can modify the status of any WooCommerce order to processed or completed without authentication. This unauthorized integrity modification could disrupt order processing workflows and potentially cause business logic issues. There is no direct impact on confidentiality or availability reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the REST API endpoints if possible or implement additional access controls at the web server or application firewall level to prevent unauthorized requests to the order endpoint.