What’s Vulnerable › Vulnerabilities
CVE-2026-12493: Clover Payment Gateway by Zaytech for WooCommerce < 1.3.6 - Unauthenticated Payment Bypass via check_order
- Severity: high (CVSS 7.5 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.4% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2026-07-27 · updated 2026-07-27
- Weakness: CWE-287
Description
The Clover Payment Gateway by Zaytech for WooCommerce WordPress plugin before 1.3.6 does not verify that an approved external payment record actually belongs to the WooCommerce order being completed, nor that the paid amount matches the order total, allowing unauthenticated users to mark arbitrary orders as paid by replaying a single genuinely-approved payment reference (for example one obtained from their own minimal purchase).
Affected products
- Clover Payment Gateway by Zaytech for WooCommerce: before 1.3.6 — fixed in 1.3.6
How to fix
Upgrade to a fixed version: Clover Payment Gateway by Zaytech for WooCommerce 1.3.6. Check the vendor advisory for mitigations.
References
Get alerted when CVE-2026-12493 or the next vulnerability affects your stack