Public mode

No access to your tenant or devices. Every item links to its source. What this means

CVE-2026-86809

Persian Elementor < 2.8.2 - Unauthenticated ZarinPal Payment Callback Authority Bypass

CVSS 3.1 5.3 MEDIUMCheck source for fixed versionsKEV status unknown

Original advisory

cve-program · CVE-2026-86809

Published

The Persian Elementor WordPress plugin from 2.7.10 before 2.8.2 does not verify that the payment authority returned to its ZarinPal payment callback belongs to the transaction being completed, allowing unauthenticated attackers to complete a pending order using a valid payment authority obtained from a different transaction.

Read the publisher's advisory

Affected versions, risk and source history

cve-program · CVE-2026-86809

Published

Persian Elementor

https://wordpress.org/plugins

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "vendor": "Unknown",
                    "product": "Persian Elementor",
                    "versions": [
                        {
                            "status": "affected",
                            "versionType": "semver",
                            "version": "2.7.10",
                            "lessThan": "2.8.2"
                        }
                    ],
                    "defaultStatus": "unaffected",
                    "collectionURL": "https://wordpress.org/plugins"
                }

Original source record · Cite this exact observation · Complete original publisher JSON