We’re actively acquiring WordPress agencies. Sell your WordPress business to Freshy.
Let’s discuss

WordPress Security Bulletin: Zarinpal Gateway for WooCommerce Plugin Vulnerability (CVE-2026-2592)

Nick Paliughi
On this page

Security Alert Summary

The Zarinpal Gateway for WooCommerce plugin for WordPress contains an improper access control vulnerability in its payment callback handler. The handler, Return_from_ZarinPal_Gateway, fails to verify that an authority token in the callback URL belongs to the specific order being marked as paid. As described in the CVE, this can allow an unauthenticated attacker to reuse a valid authority token from a different transaction of the same amount to mark orders as paid without completing payment.

CVE Details

  • CVE ID: CVE-2026-2592
  • Affected component: Zarinpal Gateway for WooCommerce plugin for WordPress
  • Affected versions: All versions up to and including 5.0.16
  • Published: February 17, 2026 at 05:16:17 AM
  • Last modified: February 17, 2026 at 05:16:17 AM
  • CVSS v3.1: Base Score 7.7, Severity HIGH, Vector String: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:H
  • Authentication / Privileges / User Interaction: Privileges Required: NONE; User Interaction: NONE; Attack Complexity: HIGH
  • Primary impact: Confidentiality: Low; Integrity: High; Availability: High
  • Weakness (CWE): CWE-284 (Improper Access Control)

Technical Details

The vulnerability exists in the plugin’s payment callback handler named Return_from_ZarinPal_Gateway. According to the CVE description, this handler does not validate that the authority token provided in the callback URL corresponds to the specific order being updated. Because the check is missing or insufficient, a valid authority token issued for one transaction can be reused to mark a different order as paid when the amounts match.

The underlying issue is an improper access-control check on the payment callback flow: the handler accepts an authority token from the request but fails to confirm ownership or association with the target order. This allows an attacker who can obtain a valid authority token from a prior transaction (of the same amount) to trigger the same success flow against a different order.

How This Could Impact Your Website

Consider a site owner running WooCommerce with staff members processing orders and an external contractor managing payments. If an attacker can obtain a valid authority token from a completed transaction, they may be able to reuse that token to mark other orders as paid without actually completing a payment. Practical consequences include incorrect order records, shipments sent for unpaid orders, and financial reconciliation issues.

While the confidentiality impact is rated low, inaccurate payment status can also increase the risk of targeted social engineering or phishing—for example, by causing confusion in customer communications or exposing patterns that could be abused for fraud attempts. If you’re unsure whether your site is affected or how to assess your current user roles and plugins, it may be worth having a professional review your setup.

Recommended Actions

  • Update the affected plugin as soon as a patched version is available. (The CVE entry does not specify a fixed version.)
  • Review and reduce unnecessary user roles and capabilities, especially for contributors and other low-privilege accounts that interact with order or payment workflows.
  • Enforce strong passwords and enable two-factor authentication for editor and administrator accounts.
  • Remove unused or unmaintained plugins and limit payment-related functionality to trusted, actively maintained extensions.
  • Monitor site activity and order logs for unusual behavior such as unexpected paid-status changes or mismatched payment references.

If you’d like help reviewing your plugins, user roles, or overall WordPress security posture, our team at Freshy is happy to help.

References

Nick Paliughihttps://freshysites.com/team/nick-paliughi/
Nick was born in California and now resides in Lake Worth, FL. He has 10 years of experience building and maintaining sites in WordPress, which he is excited to put to use at Freshy. Prior to starting at Freshy in 2022 his focus was on WordPress security & malware removal. When he’s not tending to your website, Nick is installing exhibitions at art galleries and museums in Palm Beach County, and if he’s lucky surfing at the Lake Worth pier.

See our featured website design work

Check out some of the beautiful websites we’ve built for over 2,000 clients.

View projects

We offer WordPress support & maintenance

Shake the stress of ongoing maintenance with plans supported by our team of WordPress experts.

Learn more
Previous Post
WordPress Security Bulletin: WP Maps – Store Locator,Google Maps,OpenStreetMap,Mapbox,Listing,Directory & Filters Plugin Vulnerability (CVE-2025-12062)
Next Post
WordPress Security Bulletin: Frontend File Manager Plugin (CVE-2026-0829)