CVE-2026-2592 describes an improper access control vulnerability (CWE-284) in the Zarinpal Gateway plugin for WooCommerce. The issue arises because the payment callback handler 'Return_from_ZarinPal_Gateway' fails to validate that the authority token provided in the callback URL belongs to the specific order being updated. This allows an attacker without authentication to reuse a valid authority token from a different transaction of the same amount to mark an order as paid incorrectly. The vulnerability affects all versions up to 5.0.16 and is rated with a CVSS 3.1 score of 7.7, indicating high severity.

An attacker can exploit this vulnerability to fraudulently mark orders as paid without completing a legitimate payment. This can lead to financial loss for merchants using the Zarinpal Gateway plugin by allowing unauthorized order fulfillment. The integrity and availability of the payment processing system are impacted due to improper validation of payment callbacks.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider disabling the Zarinpal Gateway plugin or implementing additional validation controls on payment callbacks to ensure authority tokens correspond to the correct orders. Monitor official Zarinpal and WooCommerce channels for updates or patches addressing this vulnerability.