Persian Elementor accepts payment authority from another transaction
Persian Elementor versions 2.7.10 through versions below 2.8.2 do not verify that the ZarinPal payment authority returned to the public callback belongs to the pending transaction being completed. An unauthenticated attacker can reuse a valid authority obtained from a different transaction to complete another pending order. The authoritative export does not identify the callback route, authority parameter, order parameter, or verification function.
- Component
- Persian Elementor
- Plugin slug
persian-elementor- Affected
- 2.7.10 to < 2.8.2
- Safe version
2.8.2- Published
- Sep 11, 2026
This CVE was published Sep 11, 2026 and is one of 2 known issues for this plugin.
Update, patch or deactivate.
Update Persian Elementor to 2.8.2 or later. The authoritative affected data marks versions below 2.8.2 affected. The application-level fix must bind the returned authority to the exact merchant, order, amount, currency, and payment session before completing an order. Audit completed orders against ZarinPal transaction records.
A safe version is available, so updating to that version or later is the preferred remediation. If an immediate update is not practical, consider a targeted application patch or temporarily restricting the affected functionality.
Deactivate only when warranted by your risk profile, or when advised by your hosting provider in the limited circumstances where the vulnerability cannot otherwise be mitigated. If you’re unsure which action is appropriate, contact Fused or your hosting provider for guidance.
Technical description
The Persian Elementor WordPress plugin from 2.7.10 before 2.8.2 does not verify that the payment authority returned to its ZarinPal payment callback belongs to the transaction being completed, allowing unauthenticated attackers to complete a pending order using a valid payment authority obtained from a different transaction.
CVE / CNA vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N