CVE-2026-12493
Clover Payment Gateway by Zaytech for WooCommerce < 1.3.6 - Unauthenticated Payment Bypass via check_order
CVSS Score
0.0
EPSS Score
0.0%
EPSS Percentile
0th
The Clover Payment Gateway by Zaytech for WooCommerce WordPress plugin before 1.3.6 does not verify that an approved external payment record actually belongs to the WooCommerce order being completed, nor that the paid amount matches the order total, allowing unauthenticated users to mark arbitrary orders as paid by replaying a single genuinely-approved payment reference (for example one obtained from their own minimal purchase).
| Vendor | unknown |
| Product | clover payment gateway by zaytech for woocommerce |
| Published | Jul 27, 2026 |
Stay Ahead of the Next One
Get instant alerts for unknown clover payment gateway by zaytech for woocommerce
Be the first to know when new unknown vulnerabilities affecting unknown clover payment gateway by zaytech for woocommerce are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
Affected Versions
Unknown / Clover Payment Gateway by Zaytech for WooCommerce
0 < 1.3.6
References
Credits
Pedro Pinho WPScan