Vulnerability · Published Feb 17, 2026 · Assigned by Wordfence

CVE-2026-2592Zarinpal Gateway for WooCommerce <= 5.0.16 - Improper Access Control to Payment Status Update

High 7.7

In plain English

A high-severity improper access control in Zarinpal Gateway from zarinpal. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 27% of all known vulnerabilities).

Severity (CVSS 3.1)7.7High

Exploit odds (30 days)0.3%top 72.8% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

The Zarinpal Gateway for WooCommerce plugin for WordPress is vulnerable to Improper Access Control to Payment Status Update in all versions up to and including 5.0.16. This is due to the payment callback handler 'Return_from_ZarinPal_Gateway' failing to validate that the authority token provided in the callback URL belongs to the specific order being marked as paid. This makes it possible for unauthenticated attackers to potentially mark orders as paid without proper payment by reusing a valid authority token from a different transaction of the same amount.

Affected products (as reported)

Vendor	Product	Versions
zarinpal	Zarinpal Gateway	0 – through 5.0.16

Weakness: CWE-284 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:H

In plain English

Official description

Affected products (as reported)

References