CVE-2026-12493
High
Description
The Clover Payment Gateway by Zaytech for WooCommerce WordPress plugin before 1.3.6 does not verify that an approved external payment record actually belongs to the WooCommerce order being completed, nor that the paid amount matches the order total, allowing unauthenticated users to mark arbitrary orders as paid by replaying a single genuinely-approved payment reference (for example one obtained from their own minimal purchase).
SeverityHigh
CVSS7.5
Exploit probability—
ProductClover Payment Gateway by Zaytech for WooCommerce
PublishedJul 27, 2026
First seenJul 27, 2026
Weakness typeCWE-287Improper authentication
How to fix
Update
- Clover Payment Gateway by Zaytech for WooCommerce1.3.6 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| Clover Payment Gateway by Zaytech for WooCommerce | v < 1.3.6 | 1.3.6 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.