Payment Processing Flaw in Clover Payment Gateway for WooCommerce by Zaytech
CVE-2026-12493
Currently unrated
What is CVE-2026-12493?
The Clover Payment Gateway for WooCommerce by Zaytech prior to version 1.3.6 contains a significant oversight in its payment verification process. It fails to ensure that an external payment record legitimately corresponds to a WooCommerce order being processed. This flaw allows unauthorized users to falsely mark any order as paid by simply reusing a valid payment reference, potentially leading to financial losses and compromised transaction integrity.
Affected Version(s)
Clover Payment Gateway by Zaytech for WooCommerce 0 < 1.3.6
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.