EUVD-2026-50952
GHSA-4hpv-v74p-q5cg
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Network-exploitable with no authentication or prerequisites; integrity-only impact via payment parameter tampering; no confidentiality or availability consequence applies.
Primary rating from Vendor (wordfence).
CVSS VectorVendor: wordfence
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Lifecycle Timeline
2DescriptionCVE.org
The Persian Elementor (المنتور فارسی) plugin for WordPress is vulnerable to Price Manipulation in all versions up to, and including, 2.8.1. This is due to the plugin trusting a user-supplied payment amount without server-side validation against the configured ZarinPal widget price. This makes it possible for unauthenticated attackers to submit arbitrary payment amounts to the ZarinPal gateway via the 'amount' parameter.
AnalysisAI
Price manipulation in the Persian Elementor WordPress plugin (all versions up to and including 2.8.1) allows unauthenticated remote attackers to submit arbitrary payment amounts to the ZarinPal payment gateway by tampering with the client-supplied 'amount' POST parameter, bypassing the price configured in the Elementor widget. The root cause is the absence of server-side reconciliation between the submitted payment figure and the widget's defined price - whatever the client sends is forwarded directly to ZarinPal. No public exploit code has been identified and the CVE is not listed in the CISA KEV catalog, though exploitation requires zero authentication and only trivial HTTP parameter manipulation.
Technical ContextAI
CWE-472 (External Control of Assumed-Immutable Web Parameter) precisely describes this pattern: the server implicitly trusts a parameter it expects to be controlled by the application rather than the user, but an attacker can intercept and modify it freely. The Persian Elementor plugin (المنتور فارسی) extends the Elementor page-builder for WordPress with native integration for ZarinPal, a major Iranian payment gateway widely used on Persian-language e-commerce sites. The vulnerable code path accepts the 'amount' field from the payment form submission and relays it to the ZarinPal API without comparing it against the price value stored in the widget configuration server-side. The fix applied in WordPress.org Trac changeset 3613858 addresses this by enforcing server-side price validation before gateway handoff. No formal CPE string was included in the input data; the affected scope is the Persian Elementor plugin ≤2.8.1 as described by NVD and Wordfence.
RemediationAI
Update the Persian Elementor plugin to the version incorporating Trac changeset 3613858 or any later release via the WordPress admin dashboard (Plugins → Updates) or via WP-CLI (wp plugin update persian-elementor). The exact patched version number was not confirmed in the available input data - the changeset reference confirms the fix was committed to the WordPress.org SVN repository, but the corresponding plugin release tag is not identified; administrators should upgrade to the latest available version and verify it is ≥ the version following 2.8.1. As an immediate compensating control while patching, disable or unpublish any Elementor page containing a ZarinPal payment widget to eliminate the vulnerable parameter from being accessible; this removes the attack surface entirely at the cost of disabling online payment functionality for that page. A WAF rule rejecting requests where the submitted 'amount' value does not match a server-authoritative price list is a lower-disruption alternative but requires custom rule authoring. See the Wordfence advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/da675a50-c7ac-4859-9795-4b0f1dc56c7b for patched version confirmation as it is updated.
The isMail transport in PHPMailer before 5.2.20 might allow remote attackers to pass extra parameters to the mail comman
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
The Hash Form - Drag & Drop Form Builder plugin for WordPress is vulnerable to arbitrary file uploads due to missing fil
The GiveWP - Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to PHP Object Injection in all
The Simple File List plugin for WordPress through version 4.2.2 contains an unauthenticated remote code execution vulner
The AI Engine WordPress plugin through version 3.1.3 exposes Bearer Token values through the /mcp/v1/ REST API endpoint
The Ninja Forms plugin before 2.9.42.1 for WordPress allows remote attackers to conduct PHP object injection attacks via
The Business Directory Plugin - Easy Listing Directories for WordPress plugin for WordPress is vulnerable to time-based
Remote code execution in WordPress 6.9.x (before 6.9.5) and 7.0.x (before 7.0.2) arises from a REST API batch endpoint r
SQL injection in the NotificationX WordPress plugin (versions up to and including 2.8.2) allows unauthenticated remote a
The POST SMTP Mailer - Email log, Delivery Failure Notifications and Best Mail SMTP for WordPress plugin for WordPress i
The MasterStudy LMS WordPress Plugin - for Online Courses and Education plugin for WordPress is vulnerable to union base
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today