Description

The Persian Elementor WordPress plugin from 2.7.10 before 2.8.2 does not verify that the payment authority returned to its ZarinPal payment callback belongs to the transaction being completed, allowing unauthenticated attackers to complete a pending order using a valid payment authority obtained from a different transaction.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.3",
  "pubDate": "2026-09-11T11:16:57.150Z",
  "pubdate": "2026-09-11T11:16:57.150Z",
  "executiveSummary": "The Persian Elementor WordPress plugin, specifically versions 2.7.10 through 2.8.1, contains a critical transaction integrity flaw within its ZarinPal payment gateway integration.\nThe vulnerability is categorized as an improper verification of cryptographic signatures or transaction identifiers, specifically regarding payment callbacks.\nAn unauthenticated attacker can manipulate the payment verification process to associate a valid ZarinPal 'Authority' token from one transaction with a separate, pending order.\nThis vulnerability allows unauthorized individuals to fulfill or complete pending orders without performing the required payment for that specific transaction.\nThe impact is significant, as it facilitates financial fraud and unauthorized service fulfillment, undermining the integrity of the plugin's e-commerce workflows.\nExploitation requires only network access to the target's callback URL and the ability to obtain an 'Authority' code from a separate, legitimate transaction within the ZarinPal ecosystem.",
  "technicalDetails": "The vulnerability originates from a failure to cryptographically or logically bind the 'Authority' parameter returned by the ZarinPal gateway to the specific session or transaction ID initiated by the plugin.\nWhen a user initiates a payment, the Persian Elementor plugin creates a local database record for the transaction. Upon redirection to ZarinPal, the gateway issues a unique 'Authority' code.\nThe callback mechanism implemented by the plugin is responsible for validating the payment status via the ZarinPal API. However, the code fails to ensure that the Authority code processed in the callback belongs to the current user's session or the specific Order ID intended for payment.\nAn attacker can exploit this by initiating their own legitimate transaction through the payment gateway to obtain a valid Authority code. Simultaneously, the attacker identifies a pending order (e.g., through intercepted traffic or predictable resource identifiers) on the victim site.\nBy crafting a request to the plugin's payment callback URL using the Authority code from their own transaction, the attacker can force the plugin to verify the payment against the ZarinPal backend.\nBecause the ZarinPal API confirms the Authority code is valid, the plugin incorrectly assumes the payment is successful for the target pending order, updating the order status to 'paid' in the database.\nThis logic flaw exists because the plugin does not implement a state-check or a cross-reference between the session-specific transaction data stored in the WordPress database and the callback parameters provided by the gateway.\nThe vulnerability affects versions 2.7.10 through 2.8.1. It is accessible over the network without authentication, as the callback endpoint is typically exposed to receive incoming webhooks from external payment service providers.\nThe post-exploitation result is the unauthorized completion of orders, which leads to direct financial loss for the site administrator and potential unauthorized delivery of goods or services."
}