The Zarinpal Gateway for WooCommerce plugin allows an attacker to change an order’s status to paid without completing a legitimate transaction by reusing an authority token that belongs to a different order. This flaw is caused by the callback handler not verifying that the token supplied matches the order in question. The result is that fraudulent orders could be marked as paid, leading to financial loss and trust erosion.

All installations of the Zarinpal Gateway for WooCommerce WordPress plugin up to and including version 5.0.16 are affected. Sites running those versions should consider themselves vulnerable.

The vulnerability has a CVSS score of 7.7 and an EPSS of less than 1 %, indicating that while the flaw is technically significant, exploitation may be rare. Because it relies on the payment callback URL and a valid authority token, an attacker can trigger it remotely by crafting a request that includes a token from another transaction of the same amount. The flaw is not listed in CISA’s KEV catalog, but the potential for unauthorized payment status changes warrants immediate remediation.