CVE-2026-86809

The Persian Elementor WordPress plugin from 2.7.10 before 2.8.2 does not verify that the payment authority returned to its ZarinPal payment callback belongs to the transaction being completed, allowing unauthenticated attackers to complete a pending order using a valid payment authority obtained...

CVE-2026-86809

The Persian Elementor WordPress plugin, versions 2.7.10 through before 2.8.2 , fails to verify that the payment authority returned in its ZarinPal payment callback belongs to the specific transaction being completed. This allows unauthenticated attackers to complete a pending order by replaying a...

PT-2026-89839

The Persian Elementor WordPress plugin from 2.7.10 before 2.8.2 does not verify that the payment authority returned to its ZarinPal payment callback belongs to the transaction being completed, allowing unauthenticated attackers to complete a pending order using a valid payment authority obtained...