EUVD-2026-76040
GHSA-ff8m-xxv4-v5mc
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Network-reachable, unauthenticated; obtaining a ZarinPal authority token is low-barrier, so AC:L holds; integrity-only impact limited to payment-state manipulation.
Primary rating from Vendor (wpscan).
CVSS VectorVendor: wpscan
Lifecycle Timeline
4DescriptionCVE.org
The Persian Elementor WordPress plugin from 2.7.10 before 2.8.2 does not verify that the payment authority returned to its ZarinPal payment callback belongs to the transaction being completed, allowing unauthenticated attackers to complete a pending order using a valid payment authority obtained from a different transaction.
AnalysisAI
Payment authority reuse in the Persian Elementor WordPress plugin (versions 2.7.10 through before 2.8.2) lets unauthenticated attackers complete pending orders without making a real payment. The ZarinPal payment callback handler accepts any valid authority token without verifying it was issued for the specific transaction being fulfilled, so an attacker who obtains an authority token from any ZarinPal transaction can submit it to a different pending order's callback and have the plugin mark that order as paid. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires two concrete preconditions: (1) the attacker must obtain a valid ZarinPal payment authority token - acquired by initiating at least one real ZarinPal transaction on any site using the gateway - and (2) the target WordPress site must be running Persian Elementor 2.7.10-2.8.1 with ZarinPal payment integration active and a pending order awaiting callback confirmation. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The provided CVSS 5.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) accurately captures the unauthenticated, network-reachable, low-complexity attack surface, but I:L arguably understates the business impact: successful exploitation allows an attacker to receive goods or services without payment, which is a direct financial fraud vector against the site operator. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Update the Persian Elementor plugin to version 2.8.2 or later via the WordPress admin Plugins dashboard or directly from the WordPress plugin repository; this is the vendor-released patch confirmed by the WPScan advisory at https://wpscan.com/vulnerability/ed1f8ac4-078b-49c6-b7c5-7d422a20e59e/. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
The mailSend function in the isMail transport in PHPMailer before 5.2.18 might allow remote attackers to pass extra para
The isMail transport in PHPMailer before 5.2.20 might allow remote attackers to pass extra parameters to the mail comman
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
The Hash Form - Drag & Drop Form Builder plugin for WordPress is vulnerable to arbitrary file uploads due to missing fil
Authentication bypass in the LiteSpeed Cache WordPress plugin (versions prior to 6.5.0.1) allows unauthenticated remote
The GiveWP - Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to PHP Object Injection in all
The Simple File List plugin for WordPress through version 4.2.2 contains an unauthenticated remote code execution vulner
The AI Engine WordPress plugin through version 3.1.3 exposes Bearer Token values through the /mcp/v1/ REST API endpoint
The SureTriggers WordPress plugin through version 1.0.82 contains a privilege escalation vulnerability that allows unaut
The Ninja Forms plugin before 2.9.42.1 for WordPress allows remote attackers to conduct PHP object injection attacks via
The Business Directory Plugin - Easy Listing Directories for WordPress plugin for WordPress is vulnerable to time-based
Remote code execution in WordPress 6.9.x (before 6.9.5) and 7.0.x (before 7.0.2) arises from a REST API batch endpoint r
Share
External POC / Exploit Code
Leaving vuln.today