Executive brief
A vulnerability in the Clover Payment Gateway plugin for WooCommerce allows unauthorized users to bypass the payment process. By reusing a valid payment reference from a small purchase, an attacker can trick the system into marking any other order as paid without actually providing funds. This could lead to significant financial loss as orders for expensive items could be processed and shipped without valid payment.
Technical details
The vulnerability exists in the 'check_order' functionality of the Clover Payment Gateway by Zaytech for WooCommerce plugin before version 1.3.6. The plugin does not verify if an approved external payment record corresponds to the specific WooCommerce order ID being processed, nor does it verify that the transaction amount matches the order total. An unauthenticated attacker can exploit this by performing a legitimate low-value transaction to obtain a valid payment reference and then replaying that reference to mark high-value orders as 'Paid'. This is classified as an authentication bypass (CWE-287) resulting from insufficient validation of payment status.
Affected products
- Zaytech Clover Payment Gateway by Zaytech for WooCommerce < 1.3.6
Timeline
- 2026-07-06: disclosed: Publicly published by WPScan
- 2026-07-27: advisory: CVE published to NVD dataset
- 2026-07-27: patched: Fixed in version 1.3.6