The vulnerability is a CSRF flaw that allows an attacker to cause authenticated users of the Smart Online Order for Clover plugin to submit requests without their consent. Because the plugin does not properly verify request authenticity, an attacker can potentially create, modify, or delete orders, or trigger other privileged actions that the plugin exposes. The impact is non-confidentiality and non-availability, focusing on unauthorized action and potential financial loss.

The Smart Online Order for Clover WordPress plugin, made by Zaytech, is vulnerable in all releases from its first version through 1.6.0. Any site running any of those releases faces risk until upgraded to a newer minor release.

The CVSS score is 4.3, reflecting a moderate risk. No EPSS data is published, and the issue is not yet in the CISA KEV list, which suggests a lower likelihood of widespread exploitation. The likely attack vector involves tricking an authenticated user into visiting a malicious link that submits a request to the plugin, inferred because CSRF requires an authenticated session. If an attacker can gain a social-engineering foothold, they could trigger unwanted actions on the site, potentially creating fraudulent orders or altering order data.