The Persian Elementor (المنتور فارسی) plugin for WordPress allows any visitor to specify the ‘amount’ parameter that is sent to the ZarinPal payment gateway. The plugin fails to validate this user‑supplied value against the price that the site owner has configured for the widget, meaning an attacker can force a different amount to be charged without authentication. This flaw can be exploited to over‑charge or under‑charge customers, resulting in financial loss and erosion of trust in the payment process. The weakness aligns with CWE‑472, which highlights the dangers of trusting external data without proper validation.

The Persian Elementor (المنتور فارسی) plugin for WordPress is affected in all versions up to and including 2.8.1. The data does not indicate whether later releases contain a fix; therefore users should verify with the vendor whether more recent versions have addressed this issue.

With a CVSS score of 5.3 the flaw is considered moderate severity. The EPSS score of <1% indicates a low likelihood of widespread exploitation at present, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is a simple HTTP request with an altered ‘amount’ parameter, making the vulnerability attractive for automated abuse. Because the attack does not require authentication, the flaw can be triggered by anyone who can send the modified request, making it a serious risk for sites that process payments without adequate server‑side validation.