WordPress Clover Payment Gateway Unauthenticated Payment Bypass via check_order (CVE-2026-12493)

WordPress Plugin Vulnerabilities Clover Payment Gateway by Zaytech for WooCommerce < 1.3.6 - Unauthenticated Payment Bypass via check_order Description The plugin fails to verify that an approved external payment record actually corresponds to the WooCommerce order being completed, nor does it ensure that the paid amount matches the order total. This allows unauthenticated users to mark arbitrary orders as paid by replaying a single legitimately approved payment reference (for example, one obtained from their own minimal purchase). Proof of Concept The PoC will be disclosed on August 06, 2026, to provide users with adequate time to update. Affected Plugins woo-clover-gateway-by-zaytech - Fixed in version 1.3.6 References CVE: CVE-2026-12493 Classification Type: AUTHBYPASS OWASP Top 10: A2: Broken Authentication and Session Management CWE: CWE-287 CVSS: 7.5 (High) Miscellaneous Original Researcher: Pedro Pinho Submitter: Pedro Pinho Verified: Yes WPVDB ID: b9f3f6d8-b5df-4d0e-9102-c69e6756ab74 Timeline Publicly Published: 2026-07-06 (approximately 21 days ago) Added: 2026-07-06 (approximately 20 days ago) Last Updated: 2026-07-24 (approximately 2 days ago) Other Published: 2021-12-14 - Title: All In One SEO < 4.1.5.3 - Authenticated Privilege Escalation Published: 2016-01-19 - Title: Simple Download Monitor <= 3.2.8 - Insufficient Authorisation Published: 2025-04-07 - Title: Asgaros Forum < 3.1.0 - Subscriber+ Authorization Bypass Published: 2024-07-08 - Title: WP2Speed Faster - Optimize PageSpeed Insights Score 90-100 <= 1.0.1 - Improper Authorization due to use of Hardcoded Credentials Published: 2026-05-28 - Title: OTP Login With Phone Number, OTP Verification < 1.8.61 - Unauthenticated Authentication Bypass via Firebase OTP Verification

Goal Reached Thanks to every supporter — we hit 100%!

WordPress Clover Payment Gateway Unauthenticated Payment Bypass via check_order (CVE-2026-12493)

More from this source