CVE-2026-12493: Clover Payment Gateway Auth Bypass Flaw

CVE-2026-12493 Overview

CVE-2026-12493 affects the Clover Payment Gateway by Zaytech for WooCommerce WordPress plugin in versions prior to 1.3.6. The plugin fails to verify that an approved external payment record belongs to the WooCommerce order being completed. It also does not confirm that the paid amount matches the order total. Unauthenticated attackers can mark arbitrary orders as paid by replaying a single genuinely-approved payment reference, such as one obtained from their own minimal purchase. The weakness is classified under CWE-287: Improper Authentication.

Critical Impact
Unauthenticated attackers can complete arbitrary WooCommerce orders without paying, causing direct financial loss to merchants using the affected plugin.

Affected Products

Clover Payment Gateway by Zaytech for WooCommerce WordPress plugin versions prior to 1.3.6
WooCommerce installations using the vulnerable plugin for external payment approval
WordPress sites relying on the plugin for order-completion validation

Discovery Timeline

2026-07-27 - CVE-2026-12493 published to NVD
2026-07-27 - Last updated in NVD database

Technical Details for CVE-2026-12493

Vulnerability Analysis

The plugin implements an external payment approval workflow that accepts a payment reference from Clover and marks the associated WooCommerce order as paid. The flaw is a missing binding between the payment reference and the specific order it was issued for. The plugin also skips validation of the paid amount against the order total. An attacker performing a single legitimate low-value purchase obtains a valid, approved payment reference. Replaying that same reference against the order-completion endpoint marks other, higher-value orders as paid.

This is a business logic authentication failure rather than a memory or injection flaw. It sits within the order state transition path where the plugin trusts the presence of an approved reference as proof of payment for the current order.

Root Cause

The root cause is [CWE-287: Improper Authentication] in the order completion handler. The plugin does not associate an approved Clover payment record with a specific WooCommerce order identifier. It also does not enforce equality between the transaction amount recorded at Clover and the WooCommerce cart total before transitioning the order to a paid state.

Attack Vector

The attack is remote, unauthenticated, and requires no user interaction. An attacker first completes a minimal genuine purchase to obtain an approved Clover payment reference. The attacker then submits requests to the plugin's order-completion endpoint using that same reference against any target order. The plugin accepts the reference and marks each targeted order as paid, allowing goods or services to be released without payment.

No verified proof-of-concept code is published. See the WPScan Vulnerability Advisory for advisory-level technical details.

Detection Methods for CVE-2026-12493

Indicators of Compromise

Multiple WooCommerce orders transitioning to a paid state while sharing the same Clover payment reference or transaction identifier.
Orders marked paid where the recorded Clover transaction amount is lower than the WooCommerce order total.
Repeated POST requests from a single client to the plugin's payment-completion endpoint targeting different order IDs in short succession.

Detection Strategies

Audit the WooCommerce order table and payment metadata for duplicate Clover transaction IDs bound to distinct order IDs.
Compare the amount captured at Clover against each WooCommerce order total and flag any mismatches.
Review web server access logs for anomalous request patterns hitting the plugin's completion route from unauthenticated sessions.

Monitoring Recommendations

Enable verbose logging on the Clover plugin's payment-completion handler and forward events to a central log platform.
Alert on any order state change to completed or processing where amount reconciliation with Clover fails.
Correlate WooCommerce order events with Clover merchant dashboard transactions on a scheduled basis.

How to Mitigate CVE-2026-12493

Immediate Actions Required

Update the Clover Payment Gateway by Zaytech for WooCommerce plugin to version 1.3.6 or later on every affected WordPress site.
Reconcile recent WooCommerce orders against Clover transaction records and reverse any orders marked paid without a matching, order-specific transaction.
Temporarily disable the plugin on sites that cannot be updated immediately and switch order acceptance to a validated payment path.

Patch Information

The vendor has released version 1.3.6 of the Clover Payment Gateway by Zaytech for WooCommerce plugin, which addresses the improper authentication issue. Refer to the WPScan Vulnerability Advisory for advisory metadata and fixed version confirmation.

Workarounds

Disable the Clover Payment Gateway plugin until the update to 1.3.6 can be applied.
Restrict access to the plugin's payment-completion endpoint at the web server or WAF layer to block unauthenticated replay attempts.
Manually verify each completed order against the Clover merchant dashboard before fulfillment while the plugin remains on a vulnerable version.

bash

# Update the plugin using WP-CLI
wp plugin update clover-payment-gateway-by-zaytech-for-woocommerce --version=1.3.6
wp plugin list --name=clover-payment-gateway-by-zaytech-for-woocommerce --fields=name,status,version