CVE-2026-1982 is a vulnerability in the Persian Elementor WordPress plugin (المنتور فارسی) that allows price manipulation due to lack of server-side validation of the payment amount parameter sent to the ZarinPal payment gateway. An unauthenticated attacker can submit arbitrary payment amounts via the 'amount' parameter, bypassing the intended price controls configured in the plugin. This vulnerability affects all versions up to and including 2.8.1. The weakness is categorized as CWE-472, which involves external control of parameters assumed to be immutable, leading to integrity issues. No official patch or remediation level has been provided as of the publication date.

The vulnerability allows attackers to alter payment amounts arbitrarily, potentially enabling them to pay less than the intended price. This compromises the integrity of payment transactions processed through the ZarinPal gateway via the affected plugin. There is no impact on confidentiality or availability reported. The vulnerability requires no privileges or user interaction to exploit.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider disabling the Persian Elementor plugin or avoid using the ZarinPal payment integration to prevent exploitation. Implementing server-side validation of payment amounts is essential to mitigate this issue once a patch or update is released.