Zarinpal Gateway for WooCommerce <= 5.0.16 — Improper Access Control to Payment Status Update

Am I affected?

• Check your version: in wp-admin go to Plugins → Installed Plugins and read the version under افزونه پرداخت امن زرین‌پال برای ووکامرس (ZarinPal for WooCommerce).
• No admin access? Run a passive check of your site. It reads public files only.
• No account is needed to exploit this. Treat any exposed site on an affected version as at risk.

What to do

1. Update to version 5.0.17, or a newer patched version
2. Rotate administrator passwords and application secrets if the site ran a vulnerable version while publicly reachable.
3. Watch افزونه پرداخت امن زرین‌پال برای ووکامرس (ZarinPal for WooCommerce) to get an email when the next vulnerability is published.

Advisory

Source description from Wordfence Intelligence, credited to shark3y.

The Zarinpal Gateway for WooCommerce plugin for WordPress is vulnerable to Improper Access Control to Payment Status Update in all versions up to and including 5.0.16. This is due to the payment callback handler 'Return_from_ZarinPal_Gateway' failing to validate that the authority token provided in the callback URL belongs to the specific order being marked as paid. This makes it possible for unauthenticated attackers to potentially mark orders as paid without proper payment by reusing a valid authority token from a different transaction of the same amount.

Exploits & references

Proof-of-concept & detection

No public proof-of-concept or detection template is known for this vulnerability.

Advisories & patches

• Advisorywordfence.com

Related CVEs

Timeline

1. Feb 16, 2026

   CVE published

   Severity high, CVSS 7.7

2. Nov 13, 2026

   Record last updated