What is GHSA-ff8m-xxv4-v5mc?

GHSA-ff8m-xxv4-v5mc is a security advisory published by GitHub Security Advisories with Medium severity. The Persian Elementor WordPress plugin from 2.7.10 before 2.8.2 does not verify that the payment...

Which CVE IDs does GHSA-ff8m-xxv4-v5mc cover?

GHSA-ff8m-xxv4-v5mc covers the following CVE IDs: CVE-2026-86809. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-ff8m-xxv4-v5mc?

GHSA-ff8m-xxv4-v5mc has a CVSS v3 base score of 5.3, published by GitHub Security Advisories.

GHSA-ff8m-xxv4-v5mcMediumCVSS 5.3

The Persian Elementor WordPress plugin from 2.7.10 before 2.8.2 does not verify that the payment...

Vendor

GitHub Security Advisories

Published

September 11, 2026

Last Modified

September 11, 2026

🔗 CVE IDs covered (1)

CVE-2026-86809 →

📋 Description

The Persian Elementor WordPress plugin from 2.7.10 before 2.8.2 does not verify that the payment authority returned to its ZarinPal payment callback belongs to the transaction being completed, allowing unauthenticated attackers to complete a pending order using a valid payment authority obtained from a different transaction.

🔗 References (3)

https://nvd.nist.gov/vuln/detail/CVE-2026-86809
https://wpscan.com/vulnerability/ed1f8ac4-078b-49c6-b7c5-7d422a20e59e
https://github.com/advisories/GHSA-ff8m-xxv4-v5mc