What is CVE-2026-86809?

CVE-2026-86809 is a medium-severity vulnerability in Persian Elementor, classified under Insufficient Verification of Data Authenticity. CVSS score: 5.3/10. Published 2026-09-11.

How severe is CVE-2026-86809?

Medium severity. CVSS v3 base score is 5.3 out of 10.

Vulnerability in Persian Elementor

CVE-2026-86809

The Persian Elementor WordPress plugin from 2.7.10 before 2.8.2 does not verify that the payment authority returned to its ZarinPal payment callback belongs to the transaction being completed, allowing unauthenticated attackers to complete a pending order using a valid payment authority obtained from a different transaction.

CVSS v3 metric

CVSS v3 base score 5.3 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N.

Affected products

Unknown Persian Elementor

Weakness classification (CWE)

CWE-345 — Insufficient Verification of Data Authenticity

References

contact@wpscan.com (technical-description, exploit, vdb-entry)

Frequently asked questions

What is CVE-2026-86809?: CVE-2026-86809 is a medium-severity vulnerability in Persian Elementor, classified under Insufficient Verification of Data Authenticity. CVSS score: 5.3/10. Published 2026-09-11.
How severe is CVE-2026-86809?: Medium severity. CVSS v3 base score is 5.3 out of 10.