CVE-2026-1305 is an improper authentication vulnerability (CWE-287) in the Japanized for WooCommerce plugin for WordPress. The issue arises because the paidy_webhook_permission_check function does not properly validate the presence of a webhook signature header, returning true unconditionally when the header is omitted. This flaw enables unauthenticated attackers to send crafted POST requests to the Paidy webhook endpoint and bypass payment verification, causing orders to be marked as Processing or Completed without actual payment confirmation. The vulnerability affects versions up to and including 2.8.4. The CVSS 3.1 base score is 5.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N), reflecting network attack vector, low attack complexity, no privileges or user interaction required, unchanged scope, no confidentiality or availability impact, but integrity impact limited to fraudulent order status changes.

An attacker can bypass payment verification by exploiting the improper authentication in the webhook permission check, allowing fraudulent marking of orders as Processing or Completed without payment. This can lead to financial loss or order fulfillment errors. There is no indication of impact on confidentiality or availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix information is provided, users should monitor the vendor's communications for updates. Until a fix is available, consider restricting access to the Paidy webhook endpoint or implementing additional webhook signature validation controls if possible.