# CVE-2026-12493: Zaytech Clover Payment Gateway for WooCommerce payment bypass

Source: https://junglewise.ai/threats/cve-2026-12493-zaytech-clover-payment-gateway-for-woocommerce-payment-bypass  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-27. Updated: 2026-07-27  
License: CC BY 4.0 with a link back

CVE-2026-12493 · Severity: info · CVSS 7.5 · Published 2026-07-27

A vulnerability in the Clover Payment Gateway plugin for WooCommerce allows unauthorized users to bypass the payment process. By reusing a valid payment reference from a small purchase, an attacker can trick the system into marking any other order as paid without actually providing funds. This could lead to significant financial loss as orders for expensive items could be processed and shipped without valid payment.

Vendors: [Zaytech](https://junglewise.ai/threats/vendors/zaytech).

## Quick answers

**Is CVE-2026-12493 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-12493 being exploited in the wild.

**How severe is CVE-2026-12493?** Informational severity, with a CVSS score of 7.5, published 27 July 2026.

**Which products and versions are affected?** Zaytech Clover Payment Gateway for WooCommerce < 1.3.6.

**Is there a fix for CVE-2026-12493?** A patch was published on 2026-07-27: Fixed in version 1.3.6 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-12493 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-12493?** Check whether you run Zaytech Clover Payment Gateway for WooCommerce at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability exists in the 'check_order' functionality of the Clover Payment Gateway by Zaytech for WooCommerce plugin before version 1.3.6. The plugin does not verify if an approved external payment record corresponds to the specific WooCommerce order ID being processed, nor does it verify that the transaction amount matches the order total. An unauthenticated attacker can exploit this by performing a legitimate low-value transaction to obtain a valid payment reference and then replaying that reference to mark high-value orders as 'Paid'. This is classified as an authentication bypass (CWE-287) resulting from insufficient validation of payment status.

## Affected products

- Zaytech Clover Payment Gateway by Zaytech for WooCommerce < 1.3.6

## Timeline

- 2026-07-06: disclosed: Publicly published by WPScan
- 2026-07-27: advisory: CVE published to NVD dataset
- 2026-07-27: patched: Fixed in version 1.3.6

## References

- [https://wpscan.com/vulnerability/b9f3f6d8-b56f-4d0e-9102-c69e6756ab74/](https://wpscan.com/vulnerability/b9f3f6d8-b56f-4d0e-9102-c69e6756ab74/)