CVE-2026-1982: Persian Elementor Price Manipulation Flaw

CVE-2026-1982 Overview

CVE-2026-1982 affects the Persian Elementor (المنتور فارسی) WordPress plugin in all versions up to and including 2.8.1. The plugin trusts a user-supplied payment amount without server-side validation against the configured ZarinPal widget price. Unauthenticated attackers can submit arbitrary payment amounts to the ZarinPal gateway through the amount parameter. This is a business logic flaw categorized under [CWE-472] (External Control of Assumed-Immutable Web Parameter).

Critical Impact
Unauthenticated attackers can manipulate payment amounts submitted to the ZarinPal gateway, allowing purchases at attacker-chosen prices and resulting in direct financial loss to site operators.

Affected Products

Persian Elementor (المنتور فارسی) WordPress plugin, versions ≤ 2.8.1
WordPress sites using the plugin's ZarinPal payment widget
E-commerce configurations relying on the plugin for ZarinPal checkout flows

Discovery Timeline

2026-07-30 - CVE-2026-1982 published to NVD
2026-07-30 - Last updated in NVD database

Technical Details for CVE-2026-1982

Vulnerability Analysis

The Persian Elementor plugin exposes a ZarinPal payment widget that initiates transactions with the ZarinPal payment gateway. When a purchase is initiated, the plugin reads the payment amount from client-controlled input rather than resolving the amount server-side from the configured widget price. Attackers submit an arbitrary value in the amount parameter, and the plugin forwards that value to ZarinPal as the authoritative transaction amount.

The flaw does not require authentication. Any anonymous visitor can trigger the checkout flow with a manipulated amount. Because the plugin never cross-checks the submitted amount against the price stored in the widget configuration, ZarinPal receives and processes whatever value the attacker specifies.

Root Cause

The root cause is missing server-side price validation, an instance of [CWE-472]. The plugin treats the amount HTTP parameter as trusted input and passes it directly into the ZarinPal payment request. A secure implementation would look up the product or widget price server-side and ignore any client-supplied amount.

Attack Vector

Exploitation occurs over the network with no authentication and no user interaction. An attacker intercepts or crafts the checkout request to the vulnerable endpoint, replaces the value of the amount parameter with a chosen figure (for example, reducing a product price to a nominal amount), and submits the request. The ZarinPal gateway is then presented with the attacker-controlled amount as the payable sum. The attacker completes the payment for the manipulated amount and obtains the goods or service at that price.

No verified proof-of-concept code has been published. Technical details are available in the Wordfence Vulnerability Report and the WordPress Plugin Change Log.

Detection Methods for CVE-2026-1982

Indicators of Compromise

ZarinPal transaction records showing amounts that do not match configured widget prices for the corresponding product or service
Completed orders with anomalously low totals originating from the Persian Elementor checkout flow
HTTP POST requests to the plugin's payment initiation endpoint containing amount values inconsistent with the site's price list

Detection Strategies

Compare each ZarinPal transaction amount against the expected widget price at the time of purchase and alert on any mismatch
Inspect web server access logs for repeated requests to the Persian Elementor payment endpoint from the same IP with varying amount values
Enable WordPress request logging and search for unauthenticated POST requests carrying the amount parameter to plugin routes

Monitoring Recommendations

Reconcile ZarinPal merchant dashboard totals against WordPress order records on a daily basis
Alert on orders with totals below a defined minimum threshold for each product category
Monitor plugin version inventory across managed WordPress sites and flag installations running Persian Elementor ≤ 2.8.1

How to Mitigate CVE-2026-1982

Immediate Actions Required

Update the Persian Elementor plugin to a version newer than 2.8.1 that includes the fix referenced in the WordPress plugin changeset 3613858
Audit ZarinPal transactions since the plugin was deployed and identify orders with amounts that do not match configured prices
Disable the ZarinPal widget in Persian Elementor until the plugin is updated if patching cannot be performed immediately

Patch Information

The vendor addressed the issue in the WordPress plugin repository under changeset 3613858. Site administrators should upgrade to the fixed release via the WordPress plugin updater. Details are documented in the WordPress Plugin Change Log and cross-referenced in the Wordfence Vulnerability Report.

Workarounds

Remove or deactivate the Persian Elementor plugin until the update is applied
Block unauthenticated POST requests to the plugin's payment endpoint at the web application firewall (WAF) layer
Configure the ZarinPal merchant account to reject or flag transactions below expected minimum amounts for the site

bash

# Example WP-CLI command to update the plugin once a fixed release is available
wp plugin update persian-elementor