Persian Elementor ZarinPal widget accepts attacker-selected payment amounts
Persian Elementor through 2.8.1 trusts the unauthenticated amount request parameter when submitting a ZarinPal widget payment instead of validating it against the widget's configured price on the server. An anonymous attacker can therefore replace the intended amount with an arbitrary lower value and send that manipulated amount to the payment gateway. The official 2.8.2 changelog states that sensitive payment data is reread directly from the server, identifying 2.8.2 as the corrected release.
- Component
- المنتور فارسی
- Plugin slug
persian-elementor- Affected
- <= 2.8.1
- Safe version
2.8.2- Published
- Jul 30, 2026
This CVE was published Jul 30, 2026 and is one of 2 known issues for this plugin.
Update, patch or deactivate.
Update Persian Elementor to 2.8.2 or later. Review ZarinPal transactions created while 2.8.1 or earlier was active for amounts that do not match the configured widget price, and reconcile or cancel affected transactions as appropriate.
A safe version is available, so updating to that version or later is the preferred remediation. If an immediate update is not practical, consider a targeted application patch or temporarily restricting the affected functionality.
Deactivate only when warranted by your risk profile, or when advised by your hosting provider in the limited circumstances where the vulnerability cannot otherwise be mitigated. If you’re unsure which action is appropriate, contact Fused or your hosting provider for guidance.
Technical description
The Persian Elementor (المنتور فارسی) plugin for WordPress is vulnerable to Price Manipulation in all versions up to, and including, 2.8.1. This is due to the plugin trusting a user-supplied payment amount without server-side validation against the configured ZarinPal widget price. This makes it possible for unauthenticated attackers to submit arbitrary payment amounts to the ZarinPal gateway via the 'amount' parameter.
CVE / CNA vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N