What is the CVSS score of CVE-2026-12493?

CVE-2026-12493 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N. EPSS exploitation probability: 0.2%.

Is there a public PoC exploit available for CVE-2026-12493?

Yes, a public proof-of-concept exploit is available for CVE-2026-12493. Prioritise patching immediately. EPSS: 0.2%.

Is there a patch available for CVE-2026-12493?

Yes, a patch is available for CVE-2026-12493. Update the affected software to the latest version immediately.

Clover Payment Gateway By Zaytech For Woocommerce CVE-2026-12493

EUVD-2026-49067 HIGH

Improper Authentication (CWE-287)

2026-07-27 WPScan

GHSA-c2pq-vc2r-qrj3

WordPress Authentication Bypass Clover Payment Gateway By Zaytech For Woocommerce Unknown

7.5

CVSS 3.1 · Vendor: WPScan

Severity by source

Vendor (WPScan) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Primary rating from Vendor (WPScan) · only source for this CVE.

CVSS VectorVendor: WPScan

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 27, 2026 - 17:24 vuln.today

CVSS changed

Jul 27, 2026 - 17:22 NVD

7.5 (HIGH)

Patch available

Jul 27, 2026 - 07:01 EUVD

CVE Published

Jul 27, 2026 - 06:00 cve.org

UNKNOWN (no severity yet)

CVE Published

Jul 27, 2026 - 06:00 cve.org

HIGH 7.5

DescriptionCVE.org

The Clover Payment Gateway by Zaytech for WooCommerce WordPress plugin before 1.3.6 does not verify that an approved external payment record actually belongs to the WooCommerce order being completed, nor that the paid amount matches the order total, allowing unauthenticated users to mark arbitrary orders as paid by replaying a single genuinely-approved payment reference (for example one obtained from their own minimal purchase).

AnalysisAI

Unauthorized order completion in Clover Payment Gateway for WooCommerce prior to 1.3.6 allows unauthenticated attackers to mark any WooCommerce order as paid by replaying a previously approved payment reference, such as one from their own minimal purchase. Public proof-of-concept code exists, and while not listed in CISA's Known Exploited Vulnerabilities, the vulnerability is automatable with partial technical impact according to SSVC analysis.