CVE-2026-2592: 
WordPress vulnerability analysis and mitigation

CVE-2026-2592 is an Improper Access Control vulnerability in the Zarinpal Gateway for WooCommerce WordPress plugin that allows unauthenticated attackers to fraudulently mark orders as paid without completing actual payment. The flaw affects all versions up to and including 5.0.16. It was published on February 17, 2026, and carries a CVSS v3.1 base score of 7.7 (High) (Feedly, Red Hat CVE).

The root cause is classified as CWE-284 (Improper Access Control). The payment callback handler Return_from_ZarinPal_Gateway fails to validate that the authority token supplied in the callback URL is bound to the specific order being marked as paid. An unauthenticated attacker can reuse a valid authority token obtained from a prior legitimate transaction of the same amount to trigger payment confirmation on a different order, effectively bypassing the payment requirement entirely (Feedly, Wordfence).

Successful exploitation allows an unauthenticated attacker to obtain goods or services from a WooCommerce store without paying, causing direct financial loss to merchants. The integrity impact is high, as order payment statuses can be manipulated; availability impact is also rated high, potentially disrupting order management workflows. Confidentiality impact is low, with limited exposure of order-related data (Feedly).

No public proof-of-concept exploit code or active in-the-wild exploitation has been reported as of the time of writing. The EPSS score is approximately 0.068%, indicating a low current probability of exploitation in the wild. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires knowledge of a valid authority token from a prior transaction of the same amount, which adds some practical complexity (Feedly).

1. Reconnaissance: Identify a target WooCommerce store using the Zarinpal Gateway plugin (version ≤ 5.0.16) by inspecting payment gateway references in the checkout flow or HTTP responses.
2. Obtain a valid authority token: Complete or initiate a legitimate Zarinpal payment transaction for the same amount as the target order, capturing the Authority token returned in the payment callback URL.
3. Identify the target order: Determine the order ID of the order to be fraudulently marked as paid (e.g., by browsing the store, placing an item in cart, or through order confirmation page enumeration).
4. Craft a malicious callback request: Construct a callback URL to the Return_from_ZarinPal_Gateway handler, substituting the target order's identifier while supplying the previously captured valid authority token.
5. Submit the callback: Send the crafted request to the WooCommerce site. Because the handler does not validate that the authority token belongs to the specific order, it marks the target order as paid, allowing the attacker to receive goods or services without payment (Feedly, Wordfence).

• Logs: WooCommerce order logs showing orders transitioning to a paid/completed status without a corresponding verified Zarinpal payment confirmation; multiple orders marked paid using the same authority token value.
• Network: Repeated or unusual HTTP GET/POST requests to the WooCommerce payment callback endpoint (e.g., URLs containing Return_from_ZarinPal_Gateway or equivalent) from unexpected IP addresses or in rapid succession.
• Application: Orders fulfilled for amounts that do not match any recorded Zarinpal transaction; the same Authority parameter value appearing in callback requests for multiple distinct order IDs in server access logs.

Store owners should update the Zarinpal Gateway for WooCommerce plugin to a version beyond 5.0.16 that includes a fix binding authority token validation to the specific order. Until a patched version is available, consider temporarily disabling the Zarinpal payment gateway and using an alternative payment method. Merchants should also audit recent orders for anomalous payment status changes and cross-reference them against actual Zarinpal transaction records (Feedly, Wordfence).

Wordfence included this vulnerability in their weekly WordPress vulnerability digest for the period of February 16–22, 2026, highlighting it as a notable access control issue affecting WooCommerce payment integrity (Wordfence). The vulnerability was also noted by security aggregators including Vulners, CIRCL, and Offseq Radar shortly after disclosure. Social media activity was limited, with a brief mention on Bluesky by The Hacker Wire.