What is the CVSS score of CVE-2026-65460?

CVE-2026-65460 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.1%.

Zarinpal Gateway CVE-2026-65460

EUVD-2026-48224 MEDIUM

Cross-Site Request Forgery (CSRF) (CWE-352)

2026-07-23 Patchstack

GHSA-h2r3-xx3r-xgf7

CSRF Zarinpal Gateway

4.3

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

vuln.today AI

4.3 MEDIUM

Network-delivered CSRF requiring victim interaction (UI:R); attacker needs no privileges (PR:N) but integrity impact is bounded to plugin-scope configuration changes (I:L), with no confidentiality or availability impact.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 23, 2026 - 13:28 vuln.today

DescriptionCVE.org

Unauthenticated Cross Site Request Forgery (CSRF) in Zarinpal Gateway <= 5.1.0 versions.

AnalysisAI

Cross-Site Request Forgery in the Zarinpal Gateway WordPress/WooCommerce plugin (versions ≤5.1.0) enables unauthenticated remote attackers to forge HTTP requests on behalf of authenticated site users or administrators, resulting in unauthorized state changes within the plugin. The CVSS vector (PR:N/UI:R/S:U/I:L) confirms exploitation requires no attacker authentication but depends on luring an authenticated victim to a malicious page. No public exploit code has been identified and this vulnerability is not listed in the CISA KEV catalog, placing it in a moderate-priority remediation tier.

Technical ContextAI

Zarinpal Gateway is a WooCommerce payment gateway plugin that integrates the Zarinpal payment processor - a service predominantly used by Iranian e-commerce merchants - into WordPress storefronts. CWE-352 (Cross-Site Request Forgery) identifies the root cause as a failure to validate the origin or authenticity of incoming HTTP requests, typically manifesting as missing or improperly checked CSRF nonces on sensitive plugin endpoints (such as settings updates or gateway configuration forms). The CPE string cpe:2.3:a:zarinpal:zarinpal_gateway:*:*:*:*:*:*:*:* covers all versions up through and including 5.1.0. Because WordPress provides built-in nonce infrastructure (wp_nonce_field / check_admin_referer), the root cause is likely failure to implement these controls on one or more plugin action handlers.

RemediationAI

Patch available per vendor advisory - update the Zarinpal Gateway plugin to a version beyond 5.1.0 if one has been released via the WordPress plugin repository; consult the Patchstack advisory at https://patchstack.com/database/wordpress/plugin/zarinpal-woocommerce-payment-gateway/vulnerability/wordpress-zarinpal-gateway-plugin-5-1-0-cross-site-request-forgery-csrf-vulnerability for the confirmed fixed version. If no patched release is yet available, a compensating control is to restrict access to the WordPress admin dashboard using IP allowlisting or HTTP authentication at the web-server layer (e.g., nginx auth_basic or Apache mod_authz_host), reducing the attack surface by requiring the attacker to also control a trusted IP - note this does not eliminate the CSRF vector but raises the exploitation bar. Additionally, enforcing a strict Content-Security-Policy and SameSite=Strict cookie attribute on the WordPress session cookie (where host configuration permits) will neutralize cross-origin request forgery attempts at the browser level without requiring a plugin update.