CVE-2026-2592 Zarinpal Gateway for WooCommerce <= 5.0.16 - Improper Access Control to Payment Status Update
Unauthenticated attackers can mark orders as paid without valid payment by reusing authority tokens, bypassing payment verification in the Zarinpal WooCommerce plugin.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-2592?
CVE-2026-2592 is a high-severity missing authorization vulnerability in Zarinpal Gateway, published on 17 Feb 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The Zarinpal Gateway for WooCommerce plugin for WordPress is vulnerable to Improper Access Control to Payment Status Update in all versions up to and including 5.0.16. This is due to the payment callback handler 'Return_from_ZarinPal_Gateway' failing to validate that the authority token provided in the callback URL belongs to the specific order being marked as paid. This makes it possible for unauthenticated attackers to potentially mark orders as paid without proper payment by reusing a valid authority token from a different transaction of the same amount.
Weakness: CWE-284
Which versions are affected by CVE-2026-2592?
How do I fix CVE-2026-2592?
No fix has been published for CVE-2026-2592 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2026-2592 being exploited?
There is no known exploitation of CVE-2026-2592 in the wild and no public exploit code.
Sources
Also known as GHSA-vpw9-rw58-f7gh.