WordPress Smart Online Order for Clover plug‑in contains an Authentication Bypass vulnerability that allows an attacker to authenticate as any user without providing valid credentials. The flaw is rated CWE-288 and enables unauthorized manipulation of orders and viewing of sensitive data; the possibility of gaining higher privileges within the WordPress site is inferred based on the ability to authenticate as any user.

The vulnerability exists in the ZAYTECH Smart Online Order for Clover plug‑in from the first release through version 1.6.0. All WordPress installations that have this plug‑in installed and have not upgraded beyond that version are affected.

The CVSS score of 7.3 classifies the flaw as high severity. Although the EPSS score is not available, the lack of a listing in the CISA KEV catalog suggests no confirmed widespread exploitation yet. The likely attack vector is a web‑based request to the plug‑in’s authentication endpoint or an alternate route that bypasses standard credential checks. An attacker who can reach the plug‑in’s management interface could potentially retrieve or modify order data and may gain further access to the underlying WordPress admin area; this is inferred from the authentication bypass.