CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
What the vulnerability does
The Persian Elementor (المنتور فارسی) plugin for WordPress is vulnerable to Price Manipulation in all versions up to, and including, 2.8.1. This is due to the plugin trusting a user-supplied payment amount without server-side validation against the configured ZarinPal widget price. This makes it possible for unauthenticated attackers to submit arbitrary payment amounts to the ZarinPal gateway via the 'amount' parameter.
Explanation of Vulnerability in Simple Terms
An attacker can modify web parameters that the application assumes are immutable, allowing them to alter data in transit. No authentication is required, and the attack works over the network without user interaction. The integrity of data processed by المنتور فارسی version 2.8.1 and earlier is at risk.
What an attacker can do
Modify web parameters to alter application data or behavior without authentication.
Potential impact on your site
Attackers can tamper with data sent to or processed by the application, potentially corrupting records or changing application behavior.
Conditions required to exploit
Network access to the application; no authentication or user interaction required.
Key dates
External resources
Related vulnerabilities
