What is GHSA-4hpv-v74p-q5cg?

GHSA-4hpv-v74p-q5cg is a security advisory published by GitHub Security Advisories with Medium severity. The Persian Elementor (المنتور فارسی) plugin for WordPress is vulnerable to Price Manipulation in...

Which CVE IDs does GHSA-4hpv-v74p-q5cg cover?

GHSA-4hpv-v74p-q5cg covers the following CVE IDs: CVE-2026-1982. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-4hpv-v74p-q5cg?

GHSA-4hpv-v74p-q5cg has a CVSS v3 base score of 5.3, published by GitHub Security Advisories.

GHSA-4hpv-v74p-q5cgMediumCVSS 5.3

The Persian Elementor (المنتور فارسی) plugin for WordPress is vulnerable to Price Manipulation in...

Vendor

GitHub Security Advisories

Published

July 30, 2026

Last Modified

July 30, 2026

🔗 CVE IDs covered (1)

CVE-2026-1982 →

📋 Description

The Persian Elementor (المنتور فارسی) plugin for WordPress is vulnerable to Price Manipulation in all versions up to, and including, 2.8.1. This is due to the plugin trusting a user-supplied payment amount without server-side validation against the configured ZarinPal widget price. This makes it possible for unauthenticated attackers to submit arbitrary payment amounts to the ZarinPal gateway via the 'amount' parameter.

🔗 References (4)

https://nvd.nist.gov/vuln/detail/CVE-2026-1982
https://plugins.trac.wordpress.org/changeset/3613858/persian-elementor
https://www.wordfence.com/threat-intel/vulnerabilities/id/da675a50-c7ac-4859-9795-4b0f1dc56c7b?source=cve
https://github.com/advisories/GHSA-4hpv-v74p-q5cg