Clover Payment Gateway WooCommerce Payment Verification Bypass

The Clover Payment Gateway by Zaytech for WooCommerce WordPress plugin before 1.3.6 does not verify that an approved external payment record actually belongs to the WooCommerce order being completed, nor that the paid amount matches the order total, allowing unauthenticated users to mark arbitrary orders as paid by replaying a single genuinely-approved payment reference (for example one obtained from their own minimal purchase).

Casky was already ahead

This CVE exploits attack patterns that Casky's 283matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

The Clover Payment Gateway plugin for WooCommerce contains a critical payment validation flaw where the application fails to verify that approved payment records belong to the specific order being completed or that the paid amount matches the order total. This allows unauthenticated attackers to replay a single valid payment reference from any legitimate transaction to mark arbitrary orders as paid, regardless of amount. The vulnerability affects WooCommerce merchants using the Clover payment integration before version 1.3.6, potentially enabling order fraud, revenue loss, and inventory manipulation for e-commerce businesses of all sizes.

Casky's 283 matching skills leverage Claude's extended reasoning to identify this vulnerability pattern across two critical MITRE ATT&CK techniques: TA0004 (Privilege Escalation) and TA0006 (Credential Access). Practitioners using Casky would detect attack indicators through payment record tampering analysis, identifying when payment validation logic fails to authenticate transaction ownership or amount verification (CWE-287: Improper Authentication). The platform would flag suspicious patterns such as payment references being reused across multiple orders, mismatches between claimed and actual payment amounts, and successful order completion without proper authorization checks. Security teams would see findings highlighting inadequate server-side validation of external payment confirmations, pointing directly to the need for order-specific payment token generation and amount verification in payment callback handlers.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

283 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-12493.

abusing-dpapi-for-credential-access

red teaming · high

Run

abusing-shadow-credentials-for-privesc

red teaming · high

Run

Access with Stolen Session Cookie

identity access management · low

Run

MITRE ATT&CK Techniques

TA0004 TA0006

Investigate the attack patterns behind CVE-2026-12493

Casky has 283 skills that investigate the attack patterns behind CVE-2026-12493. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn