CVE-2025-15635

CVE-2025-15635 is a Cross-Site Request Forgery (CSRF) vulnerability affecting ZAYTECH Smart Online Order for Clover, impacting versions 1.6.0 and earlier. This flaw allows attackers to perform unauthorized actions on behalf of authenticated users through malicious web requests. The vulnerability poses a risk to e-commerce operations utilizing this Clover-integrated ordering system. The vulnerability carries a CVSS score of 4.3 (Medium severity) with a network-based attack vector requiring minimal complexity and user interaction to exploit. The attack has limited impact, affecting data integrity rather than confidentiality or availability. The EPSS score of 0.00016 indicates minimal exploitation probability relative to the broader CVE landscape. There is currently no evidence of active exploitation in the wild, as the vulnerability is not listed on the Known Exploited Vulnerabilities catalog. No public exploit code has been identified, and community attention remains low, as reflected by the inactive status on security tracking lists. Organizations using this plugin should prioritize patching to versions above 1.6.0, though the immediate risk level remains modest based on current threat indicators.