What is the CVSS score of CVE-2026-57340?

CVE-2026-57340 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L. EPSS exploitation probability: 0.2%.

Japanized For WooCommerce CVE-2026-57340

EUVD-2026-40111 MEDIUM

Missing Authorization (CWE-862)

2026-06-29 Patchstack

GHSA-fvhx-wf6j-vcv7

WordPress Authentication Bypass Japanized For Woocommerce Wordpress Plugin

6.5

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L

vuln.today AI

6.5 MEDIUM

Network-reachable with no auth required; impact is bounded to partial integrity and availability with no confidentiality exposure, consistent with authorization bypass on a localization plugin.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

Jun 29, 2026 - 15:23 vuln.today

CVE Published

Jun 29, 2026 - 13:36 cve.org

MEDIUM 6.5

DescriptionCVE.org

Unauthenticated Broken Access Control in Japanized For WooCommerce <= 2.9.12 versions.

AnalysisAI

Unauthenticated broken access control in the Japanized For WooCommerce WordPress plugin (versions <= 2.9.12) allows remote unauthenticated attackers to bypass authorization checks and perform restricted operations, resulting in limited integrity and availability impact. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms no authentication or user interaction is required, lowering the exploitation barrier significantly for any exposed WordPress site running this plugin. No public exploit code or CISA KEV listing has been identified at time of analysis, though the low complexity and zero-privilege requirement make this accessible to unsophisticated attackers.

Technical ContextAI

The vulnerability is classified under CWE-862 (Missing Authorization), meaning the plugin fails to verify that a requesting user has the necessary permissions before executing sensitive operations - a common flaw pattern in WordPress plugins where REST API endpoints or AJAX handlers are registered without nonce verification or capability checks. The affected product is the Japanized For WooCommerce plugin (CPE: cpe:2.3:a:shohei.tanaka:japanized_for_woocommerce:*:*:*:*:*:*:*:*), a WooCommerce localization plugin authored by Shohei Tanaka designed to adapt WooCommerce stores for the Japanese market. WordPress plugins frequently expose wp-admin/admin-ajax.php or REST API endpoints that, without proper authorization middleware, can be triggered by any HTTP client regardless of authentication state.

RemediationAI

The primary remediation is to update the Japanized For WooCommerce plugin to a version beyond 2.9.12 via the WordPress plugin dashboard or wp-cli (wp plugin update woocommerce-for-japan). An exact patched version number is not confirmed in the available source data - verify the current release version against the Patchstack advisory at https://patchstack.com/database/wordpress/plugin/woocommerce-for-japan/vulnerability/wordpress-japanized-for-woocommerce-plugin-2-9-12-broken-access-control-vulnerability before updating. If an update is not immediately available, a compensating control is to use a Web Application Firewall (WAF) rule to block unauthorized access to the plugin's exposed endpoints; Patchstack's WAF rules can provide virtual patching in this case. Temporarily deactivating the plugin is a disruptive but effective stopgap if the store can operate without Japan-specific localization features, though this will affect checkout and shipping configurations targeting Japanese customers.