PT-2026-66351 · Mohammadr3Z · المنتور فارسی

Chiao-Lin Yu · CVE-2026-1982 · Publicado 2026-07-30 · Atualizado 2026-07-30

Mitre

CVSS v3.1

5.3

Média

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

The Persian Elementor (المنتور فارسی) plugin for WordPress is vulnerable to Price Manipulation in all versions up to, and including, 2.8.1. This is due to the plugin trusting a user-supplied payment amount without server-side validation against the configured ZarinPal widget price. This makes it possible for unauthenticated attackers to submit arbitrary payment amounts to the ZarinPal gateway via the 'amount' parameter.

Correção

Enumeração de Fraquezas

CWE-472

Identificadores relacionados

CVE-2026-1982

Produtos afetados

المنتور فارسی

Referências · 3

• https://plugins.trac.wordpress.org/changeset/3613858/persian-elementor · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2026-1982 · Nota de Segurança
• https://wordfence.com/threat-intel/vulnerabilities/id/da675a50-c7ac-4859-9795-4b0f1dc56c7b?source=cve · Nota