The WooCommerce Clover Payment Gateway plugin for WordPress suffers from an improper access control vulnerability (CWE-284) due to the absence of a capability check in the callback_handler function. This flaw allows unauthenticated attackers to modify order data by marking orders as paid, impacting all plugin versions up to 1.3.1. The vulnerability has a CVSS v3.1 base score of 5.3, reflecting a medium severity with network attack vector, low attack complexity, no privileges required, and no user interaction needed. No official patch or vendor advisory confirming remediation is currently available.

An attacker can exploit this vulnerability to mark orders as paid without authorization, potentially leading to fraudulent order processing and financial discrepancies. The integrity of order payment data is compromised, but confidentiality and availability are not affected. There are no reports of active exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider disabling the plugin or restricting access to the callback endpoint if possible. Monitor for updates from the vendor or WordPress plugin repository to apply any forthcoming patches promptly.