CVE-2026-1982 is a price manipulation vulnerability in a WordPress plugin with ZarinPal payment gateway integration. The plugin accepts a client-supplied 'amount' parameter and sends it directly to the payment gateway without retrieving the authoritative price from server-side storage at transaction initiation. An attacker can submit their own payment request with a manipulated amount — no interception of legitimate transactions required. The vulnerability exists because the payment initiation layer treats price as a user preference rather than a server-controlled invariant.
The CVSS score of 5.3 is misleading. This score reflects a framework built for bounded technical defects, not unbounded business-layer failures. A price manipulation flaw scales with transaction volume — every single transaction on a compromised site becomes a potential extraction vector. The 'Low' Attack Complexity and 'None' Privileges Required in the CVSS vector capture neither the zero-authentication requirement nor the unbounded monetary scope. You are not looking at a medium-severity defect; you are looking at a live financial extraction endpoint with no barrier to exploitation.
Check your environment: Identify whether the ZarinPal integration in your WordPress plugin fetches the authoritative product price from server-side storage (post_meta or database) at the moment payment is initiated, or whether it accepts and passes through the amount parameter from the client request. If the latter, you are vulnerable. The patched version (2.8.2+) should enforce server-side price retrieval — verify the patch actually performs server-side lookup rather than adding client-side or gateway-side validation that could be bypassed. Audit your payment logs for reconciliation against actual product prices, as exploitation may leave no obvious technical trace in standard WordPress logs. Given the MEDIUM CVSS signal, patch prioritization systems may deprioritize this, but the actual exposure window grows with every day between CVE publication and patch deployment — treat this as an urgent item regardless of scoring distortions.