Log out
Get PRO

Latest

Access violation vulnerability in Zarinpal Gateway 5.0.16

  • Severity: high-risk
  • Status: Fixed
  • Publication: February 16, 2026

A popular plugin for WordPress called Zarinpal Gateway for WooCommerce has a security issue in all versions up to 5.0.16. This is because the system responsible for confirming payment, called ‘Return_from_ZarinPal_Gateway’, doesn’t check if the token that gives access to the payment status actually belongs to the correct order. This means that someone who isn’t authorized could falsely mark an order as paid by using a valid token from a different transaction of the same amount.

Detected in:

Zarinpal Gateway fixed vulnerable versions: >= * <= 5.0.16

This information is sourced from www.wpvulnerability.com. An open-source database of vulnerabilities maintained by the community. Help us out by submitting vulnerabilities!

Version compare shows which versions have a vulnerability. For example: >= 2.2.8 <= 2.2.21 means:

> from 2.2.8
= including 2.2.8 & 2.2.21
< to 2.2.21

  • Incorrect?

Is this information incorrect? Please leave us a message.