WordPress Clover Payment Gateway未授权支付绕过漏洞(CVE-2026-12493)

WordPress Plugin Vulnerabilities Clover Payment Gateway by Zaytech for WooCommerce < 1.3.6 - Unauthenticated Payment Bypass via check_order Description The plugin does not verify that an approved external payment record actually belongs to the WooCommerce order being completed, nor that the paid amount matches the order total, allowing unauthenticated users to mark arbitrary orders as paid by replaying a single genuinely-approved payment reference (for example one obtained from their own minimal purchase). Proof of Concept The PoC will be displayed on August 06, 2026, to give users the time to update. Affects Plugins woo-clover-gateway-by-zaytech - Fixed in 1.3.6 References CVE: CVE-2026-12493 Classification Type: AUTHBYPASS OWASP top 10: A2: Broken Authentication and Session Management CWE: CWE-287 CVSS: 7.5 (high) Miscellaneous Original Researcher: Pedro Pinho Submitter: Pedro Pinho Verified: Yes WPVDB ID: b9f3f6d8-b5df-4d0e-9102-c69e6756ab74 Timeline Publicly Published: 2026-07-06 (about 21 days ago) Added: 2026-07-06 (about 20 days ago) Last Updated: 2026-07-24 (about 2 days ago) Other Published: 2021-12-14 - Title: All In One SEO < 4.1.5.3 - Authenticated Privilege Escalation Published: 2016-01-19 - Title: Simple Download Monitor <= 3.2.8 - Insufficient Authorisation Published: 2025-04-07 - Title: Asgaros Forum < 3.1.0 - Subscriber+ Authorization Bypass Published: 2024-07-08 - Title: WP2Speed Faster - Optimize PageSpeed Insights Score 90-100 <= 1.0.1 - Improper Authorization due to use of Hardcoded Credentials Published: 2026-05-28 - Title: OTP Login With Phone Number, OTP Verification < 1.8.61 - Unauthenticated Authentication Bypass via Firebase OTP Verification

目标达成感谢每一位支持者 — 我们达成了 100% 目标！

WordPress Clover Payment Gateway未授权支付绕过漏洞(CVE-2026-12493)

同源更多文章

目标达成 感谢每一位支持者 — 我们达成了 100% 目标！

WordPress Clover Payment Gateway未授权支付绕过漏洞(CVE-2026-12493)

同源更多文章

目标达成感谢每一位支持者 — 我们达成了 100% 目标！