WooCommerce Clover Payment Bug: Fake Paid Orders

A bug in the Clover Payment Gateway by Zaytech plugin for WooCommerce (tracked as CVE-2026-12493) lets anyone on the internet mark your store's orders as "paid" without paying, just by reusing one genuine payment confirmation from a small purchase they already made.

This is for WooCommerce store owners, shop managers, and agencies running the Clover Payment Gateway by Zaytech plugin to accept Clover card payments. Below: exactly what the bug does, whether your store is exposed, and the two things to do today, in plain English.

What CVE-2026-12493 actually is

When Clover approves a payment, this plugin is supposed to check that the approval belongs to the specific order being paid for, and that the amount paid matches the order total, before marking the order "paid" in WooCommerce. According to the NVD record for CVE-2026-12493, versions of the plugin before 1.3.6 skip both of those checks.

That gap means an unauthenticated visitor, no account or login required, can replay a single real, approved payment reference (for example, one they got from buying a $1 item) and attach it to a completely different order, including one worth hundreds of dollars. WooCommerce sees an "approved" signal and marks the order paid. No card is ever charged for the real order.

This is classified as CWE-287, Improper Authentication: the plugin fails to properly confirm that the party and the payment it's trusting actually correspond to the order in question.

The CVE at a glance

"Deferred" on NVD just means the record hasn't gone through full NVD analyst enrichment yet, not that the bug is any less real. Treat it as confirmed and current.

Why the CVSS score looks the way it does

The 7.5 High score comes from a mix that's worth understanding, because it tells you exactly what's at risk:

• AV:N (Network) + AC:L (Low complexity) + PR:N (no privileges) + UI:N (no user interaction): an attacker needs nothing but your store's URL and a browser. No account, no admin access, no tricking a victim into clicking anything.
• C:N (no confidentiality impact): this bug doesn't leak customer data, card numbers, or anything from your database.
• I:H (high integrity impact): this is the real damage. The attacker can falsify a financial record, your order status, to get goods or services without paying.
• A:N (no availability impact): your site keeps running normally. There's no outage to tip you off.

That last point is why this kind of bug is dangerous in a quiet way: nothing crashes, nothing looks broken, and the first sign is usually a pile of "paid" orders that were never actually paid for.

Who's affected

If your WooCommerce store uses the Clover Payment Gateway by Zaytech plugin and you're running a version older than 1.3.6, you're exposed. It doesn't matter how small your store is or how little traffic you get: because the attack needs no login and no social engineering, it can be run against any public WooCommerce checkout that uses the vulnerable plugin, by anyone who finds it.

If you don't use this specific Clover plugin, this particular CVE doesn't apply to you, but the underlying risk category, a payment plugin trusting a status flag it hasn't fully verified, shows up across many WooCommerce payment integrations. It's one of the more common WooCommerce payment plugin vulnerability patterns we see.

What to do right now

1. Check your version. In WordPress admin, go to Plugins and find "Clover Payment Gateway by Zaytech." The installed version is listed under the plugin name.
2. Update immediately if you're below 1.3.6. Use the normal Plugins > Update screen, or grab the latest build from the vendor if WordPress.org shows an older release. The NVD record doesn't list a different fixed version, so 1.3.6 or newer is the target; if you ever can't confirm the version number, update to the latest available release and check the vendor's changelog to be sure the fix is included.
3. Can't update right now? Temporarily disable Clover as a payment method under WooCommerce > Settings > Payments until you can patch. A paused payment option is a smaller problem than free orders going out.
4. Contact Zaytech support if you're on a licensed or customized build and don't see 1.3.6 available, referencing CVE-2026-12493 directly.
5. Re-check after updating that the version number in Plugins now reads 1.3.6 or higher.

How to tell if you've already been hit

Before you assume you're fine, spend ten minutes looking at your order history:

• Go to WooCommerce > Orders and filter for "Processing" or "Completed" orders.
• Open your Clover merchant dashboard and compare settled transaction amounts against the matching WooCommerce order totals.
• Flag any order marked paid with no corresponding Clover transaction, or where the Clover amount is far smaller than the order total, that's the signature of this bug (a cheap, real payment reused against an expensive order).
• Check timing: a tiny real order followed quickly by a large "paid" order from the same or a similar customer/IP is worth a second look.
• If you find a fraudulent "paid" order that's already been shipped or fulfilled, treat it as a loss and decide your refund/chargeback-prevention policy going forward.

If you find evidence of ongoing fraud or a wider compromise beyond fake orders, our guide on what to do if your website has been hacked walks through containment and cleanup.

Protecting your store from payment fraud going forward

This specific bug gets fixed by updating one plugin, but it's a good prompt to tighten up payment handling generally:

• Keep every payment-related plugin on auto-update or check it weekly, these are the highest-value targets on any store.
• Periodically reconcile WooCommerce order totals against your actual payment processor dashboard, not just order status labels.
• Don't rely on any single "approved" flag from a payment gateway as the only proof of payment; cross-check amount and order ID whenever you can.
• Run a free check on your overall exposure with our free website security check, or read how to tell if your website is hackable for a broader self-assessment.

Key takeaways

• CVE-2026-12493 is a High-severity (CVSS 7.5) bug in Clover Payment Gateway by Zaytech for WooCommerce, versions before 1.3.6, letting anyone mark orders paid by replaying a single real payment reference.
• No login or customer interaction is needed by the attacker, and no customer data is exposed; the damage is financial (fake "paid" orders), not a data breach.
• Update the plugin to version 1.3.6 or later today; if you can't, disable the Clover payment method until you can.
• Audit recent orders against your Clover merchant dashboard for amount mismatches or orders with no matching real transaction.
• Treat any payment-gateway plugin as high-priority for updates going forward, these bugs tend to be quiet until the fraud shows up in your books.

If you want a second set of eyes on your WooCommerce setup beyond this one CVE, a Bug Circuit Circuit audit is a real person manually checking your site, including payment and order-handling logic, for $49, with a plain-English report of anything they find and exactly how to fix it.

FAQ

What is the Clover Payment Gateway WooCommerce bug? It's CVE-2026-12493, a flaw in the Clover Payment Gateway by Zaytech plugin (versions before 1.3.6) where the plugin marks a WooCommerce order paid without checking that the payment confirmation actually belongs to that order or matches its total. That lets someone reuse one real payment reference to fake payment on other orders.

Can WooCommerce orders really be marked paid without paying? Yes, in this specific case. The plugin trusted an "approved payment" signal from Clover without verifying it was tied to the right order and amount, so a single genuine small payment could be replayed against a larger, unpaid order. Updating to version 1.3.6 fixes this.

Is Clover Payment Gateway by Zaytech still safe to use? Yes, once you're on version 1.3.6 or later, which closes this specific hole. If you're on an older version, treat it as unsafe for live payments until you update or temporarily disable it as a checkout option.

How do I protect my WooCommerce store from payment fraud? Keep payment plugins updated immediately when security fixes ship, regularly reconcile your WooCommerce order totals against your payment processor's actual transaction records, and don't rely on a single status flag as proof of payment. A periodic manual security review also catches logic flaws like this one that automated scanners often miss.

Do I need to update right now, or can it wait? Update now if you're below version 1.3.6. The attack needs no login and no victim interaction, so any public checkout running the vulnerable version is exposed the moment someone finds it; there's no safe window to wait it out.