What’s Vulnerable › Vulnerabilities
CVE-2026-86809: Persian Elementor < 2.8.2 - Unauthenticated ZarinPal Payment Callback Authority Bypass
- Severity: medium (CVSS 5.3 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.2% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2026-09-11 · updated 2026-09-11
- Weakness: CWE-345
Description
The Persian Elementor WordPress plugin from 2.7.10 before 2.8.2 does not verify that the payment authority returned to its ZarinPal payment callback belongs to the transaction being completed, allowing unauthenticated attackers to complete a pending order using a valid payment authority obtained from a different transaction.
Affected products
- Persian Elementor: from 2.7.10 before 2.8.2 — fixed in 2.8.2
How to fix
Upgrade to a fixed version: Persian Elementor 2.8.2. Check the vendor advisory for mitigations.
References
Get alerted when CVE-2026-86809 or the next vulnerability affects your stack