The Clover Payment Gateway by Zaytech for WooCommerce plugin prior to version 1.3.6 contains an improper authentication vulnerability (CWE-287). It does not validate that an external payment record is associated with the correct WooCommerce order nor that the payment amount matches the order total. Consequently, an attacker can reuse a genuine payment reference from their own transaction to fraudulently mark other orders as paid without authentication. This vulnerability has a CVSS 3.1 base score of 7.5 (high severity) with network attack vector, low attack complexity, no privileges required, no user interaction, and impacts integrity but not confidentiality or availability.

An attacker can manipulate the payment status of arbitrary orders by replaying a valid payment reference from their own transaction, causing orders to be marked as paid without actual payment. This compromises the integrity of the order payment process, potentially leading to financial loss for merchants using the affected plugin versions. There is no indication of impact on confidentiality or availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or patch is currently documented, users should monitor the vendor's communications for updates. Until a fix is available, consider disabling the Clover Payment Gateway plugin or restricting its use to trusted environments to prevent exploitation.