CVE-2026-86809 Overview
CVE-2026-86809 affects the Persian Elementor WordPress plugin from version 2.7.10 before 2.8.2. The plugin fails to verify that the payment authority returned to its ZarinPal payment callback belongs to the transaction being completed. Unauthenticated attackers can reuse a valid payment authority obtained from a different transaction to complete a pending order. The flaw stems from insufficient verification of data authenticity [CWE-345] in the payment callback handler.
Critical Impact
Unauthenticated attackers can complete pending WordPress store orders without paying, by replaying a valid ZarinPal payment authority from an unrelated transaction.
Affected Products
- Persian Elementor WordPress plugin version 2.7.10
- Persian Elementor WordPress plugin versions up to and including 2.8.1
- WordPress sites integrating ZarinPal payment gateway through Persian Elementor
Discovery Timeline
- 2026-09-11 - CVE-2026-86809 published to NVD
- 2026-09-11 - Last updated in NVD database
Technical Details for CVE-2026-86809
Vulnerability Analysis
The Persian Elementor plugin integrates the ZarinPal payment gateway to process WordPress store transactions. When a customer initiates payment, ZarinPal issues an authority token that identifies the pending transaction. After payment, ZarinPal redirects the customer back to a callback endpoint on the WordPress site with that authority value.
The plugin trusts the authority parameter without validating that it corresponds to the specific pending order being finalized. An attacker who obtains any valid authority token from any successful ZarinPal transaction can submit that value to the callback endpoint of a different pending order. The plugin then marks the unrelated order as paid.
This is a business logic flaw that maps to insufficient verification of data authenticity [CWE-345]. The impact is limited to integrity of order state; confidentiality and availability are not affected.
Root Cause
The callback handler does not bind the incoming ZarinPal authority to the order record it was originally issued for. The verification step confirms only that the authority exists and represents a completed payment, not that the payment amount, merchant reference, and target order match.
Attack Vector
The attack is network-based, requires no authentication, and no user interaction. An attacker who has previously completed any small ZarinPal payment through a vulnerable Persian Elementor endpoint can retain the returned authority. The attacker then places an order of any value, intercepts or crafts the callback URL, and substitutes the previously obtained authority to finalize the new order as paid.
See the WPScan Vulnerability Report for additional technical detail. No public proof-of-concept exploit is currently listed for this CVE.
Detection Methods for CVE-2026-86809
Indicators of Compromise
- Orders transitioning to a paid or completed state without a matching ZarinPal settlement record for the same amount and reference.
- Repeated use of the same ZarinPal Authority value across multiple order callback requests in web server access logs.
- Callback requests to the plugin's ZarinPal return endpoint originating from IP addresses that never initiated the corresponding checkout session.
Detection Strategies
- Reconcile WordPress order records against ZarinPal merchant transaction reports and flag orders marked paid without a corresponding gateway settlement.
- Parse web server logs for the plugin's ZarinPal callback URL and alert on duplicate Authority query parameter values.
- Correlate checkout session identifiers with callback IP and user-agent to detect mismatches between the buyer session and the finalizing request.
Monitoring Recommendations
- Enable verbose logging on the Persian Elementor payment callback endpoint including full query string and referrer.
- Forward WordPress and web server logs to a centralized log platform and retain them long enough to support retrospective reconciliation.
- Configure alerts for sudden increases in successful order completions that are not matched by gateway revenue.
How to Mitigate CVE-2026-86809
Immediate Actions Required
- Upgrade the Persian Elementor WordPress plugin to version 2.8.2 or later on all affected sites.
- Audit recent orders completed through the ZarinPal gateway against ZarinPal settlement data and reverse any fraudulent fulfillment.
- Rotate ZarinPal merchant credentials if abuse is suspected and review shipping queues for orders that were fulfilled without payment.
Patch Information
The vendor addressed the issue in Persian Elementor version 2.8.2. Refer to the WPScan Vulnerability Report for advisory details and version metadata.
Workarounds
- Temporarily disable the Persian Elementor ZarinPal payment method until the plugin is updated to 2.8.2.
- Restrict access to the ZarinPal callback endpoint at the web application firewall to require a session cookie tied to the originating checkout.
- Manually verify each ZarinPal payment against the merchant dashboard before releasing goods or digital fulfillment.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
