CVE-2026-86809

MediumCVSS 5.3/10Last modified Sep 11, 2026

Description

The Persian Elementor WordPress plugin from 2.7.10 before 2.8.2 does not verify that the payment authority returned to its ZarinPal payment callback belongs to the transaction being completed, allowing unauthenticated attackers to complete a pending order using a valid payment authority obtained from a different transaction.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Weakness enumeration

CWE-345

Affected software

No affected versions have been published.

Timeline

Published: Sep 11, 2026
Last modified: Sep 11, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-86815.3The Essential Chat Support plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.0.1. This is d CVE-2026-868107.3A vulnerability was detected in Open-Web-Analytics up to 1.9.1. The impacted element is the function checkCapabilityAndAuthenticateUser of t CVE-2026-868126.5The WPCafe WordPress plugin before 3.0.18 does not correctly restrict access to a set of order-management REST endpoints because their perm CVE-2026-868134.8The MetForm WordPress plugin before 4.1.9 does not properly neutralize newline characters in user-submitted values that are placed into noti CVE-2026-868148.1The UsersWP WordPress plugin before 1.5.10 does not verify that a social login provider has confirmed ownership of an email address before CVE-2026-868155.5The BackWPup WordPress plugin before 5.7.5 does not properly restrict access to several of its REST API routes for job, backup-destination,CVE-2026-868165.3The WPCafe WordPress plugin before 3.0.21 does not restrict access to some of its REST API endpoints, allowing unauthenticated attackers to CVE-2026-868174.9The Five Star Business Profile and Schema WordPress plugin before 2.4.0 does not properly restrict the callbacks used to resolve schema fiel CVE-2026-868184.8fast-uri is a dependency-free RFC 3986 URI parser for Node.js, used by Fastify and ajv, that added a mailto scheme parser in version 4.1.3. CVE-2026-868197.1Waves Central for macOS contains a local privilege escalation in the privileged helper service. The helper authorizes connecting XPC clients CVE-2026-86824.3The 3D Viewer – 3D Model Viewer – Augmented Reality – Virtual Try On plugin for WordPress is vulnerable to authorization bypass in all versi CVE-2026-868235.3The Newsletter WordPress plugin before 9.3.7 does not validate the destination of the redirect performed after a public subscription action