# CVE-2026-86809

## Summary

- **CVE ID:** CVE-2026-86809
- **Severity:** MEDIUM
- **CVSS Score:** 5.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N)
- **CWE:** N/A
- **Published:** Sep 11, 2026
- **Last Modified:** Sep 11, 2026

## Description

The Persian Elementor WordPress plugin from 2.7.10 before 2.8.2 does not verify that the payment authority returned to its ZarinPal payment callback belongs to the transaction being completed, allowing unauthenticated attackers to complete a pending order using a valid payment authority obtained from a different transaction.

## Affected Products

- Unknown — Persian Elementor (2.7.10)

## References

- [CNA](https://wpscan.com/vulnerability/ed1f8ac4-078b-49c6-b7c5-7d422a20e59e/)

## Exploitation Prediction (EPSS)

- **EPSS Score:** 0.11%
- **EPSS Percentile:** 1.7

---
_Exported from OnDuty AI Vulnerability Intelligence on 2026-09-19._