The Clover Payment Gateway by Zaytech for WooCommerce WordPress plugin before 1.3.6 has a vulnerability allowing unauthenticated users to mark arbitrary orders as paid. This is possible because the plugin does not verify that an approved external payment record actually belongs to the WooCommerce order being completed, nor that the paid amount matches the order total. An attacker can exploit this by repla [truncated]
A Cross-Site Request Forgery (CSRF) vulnerability exists in the Smart Online Order for Clover plugin, affecting versions from n/a through 1.6.0. This issue allows attackers to perform actions on behalf of users without their consent. The vulnerability has a medium severity and defenders should prioritize verifying exposure, particularly for systems using affected plugin versions, and implement CSRF protec [truncated]
