Research Plan: Zarinpal Gateway Payment Status Bypass (CVE-2026-2592)

1. Vulnerability Summary

The Zarinpal Gateway for WooCommerce plugin (up to 5.0.16) contains an improper access control vulnerability in its payment callback handler. The function Return_from_ZarinPal_Gateway processes payment confirmations from Zarinpal. While it verifies with the Zarinpal API that a given Authority token is paid, it fails to ensure that the Authority token being verified is the one actually associated with the order_id provided in the request.

This allows an attacker to take a valid Authority token from a previously completed, low-value transaction and reuse it to mark a new, unpaid order of the same amount as "Paid" by passing the new order's ID in the callback URL.

2. Attack Vector Analysis

• Endpoint: /?wc-api=wc_zpal
• Hook: add_action('woocommerce_api_wc_zpal', array($this, 'Return_from_ZarinPal_Gateway'))
• Vulnerable Parameter: Authority and order_id (via $_GET)
• Authentication: Unauthenticated
• Preconditions:
  1. The attacker must have a valid Authority token that has been marked as paid/verified by Zarinpal (can be obtained by completing a legitimate small transaction).
  2. The target order must have the same total amount as the transaction associated with the reused Authority token (since the Zarinpal Verification API requires the amount).

3. Code Flow

1. Entry Point: An unauthenticated HTTP GET request is made to /?wc-api=wc_zpal.
2. Handler: WooCommerce triggers WC_ZPal::Return_from_ZarinPal_Gateway.
3. Order Retrieval: The plugin retrieves the order ID from $_GET['order_id'] and the authority from $_GET['Authority'].
4. Verification: The plugin calls ZarinpalHelperClass::verify, passing the Authority and the current order's total amount.
5. The Flaw: The Zarinpal API confirms that the Authority is valid and paid for that amount. The plugin then calls $order->payment_complete() or updates the status. It never checks if $order->get_meta('_zarinpal_authority') matches the Authority provided in $_GET.
6. Sink: $order->payment_complete() is called, marking the order as paid.

4. Nonce Acquisition Strategy

This vulnerability exists in a webhook/callback handler registered via the woocommerce_api_{id} hook.

• Nonce Requirement: None. These endpoints are designed to be accessed by external payment gateways and do not implement WordPress nonces.
• Verification: The Return_from_ZarinPal_Gateway function does not contain any check_ajax_referer or wp_verify_nonce calls.

5. Exploitation Strategy

The exploit involves a "Replay Attack" of a valid authority token against a different order ID.

Step 1: Setup Zarinpal in Sandbox Mode

1. Configure the gateway settings via WP-CLI to enable it and set it to sandbox mode.
2. Set a dummy Merchant Code.

Step 2: Obtain a Valid "Paid" Authority

1. Create a "Legitimate Order" (Order A) for a specific amount (e.g., 1000).
2. Initiate payment to get an Authority token.
3. In Sandbox mode, the token can usually be verified as paid by calling the callback with Status=OK.

Step 3: Create the Target Order

1. Create a "Target Order" (Order B) as a guest user for the same amount (1000).
2. Capture the order_id for Order B.

Step 4: Perform the Bypass

1. Send an unauthenticated request to the callback URL targeting Order B but using the Authority from Order A.

Request:

GET /?wc-api=wc_zpal&order_id=[ORDER_B_ID]&Authority=[ORDER_A_AUTHORITY]&Status=OK HTTP/1.1
Host: [target_host]

6. Test Data Setup

1. Product: Create a product with price 1000:
   wp post create --post_type=product --post_title='Test Product' --post_status=publish --meta_input='{"_price":1000, "_regular_price":1000}'
2. Plugin Config:
   wp option update woocommerce_wc_zpal_settings '{"enabled":"yes","merchantcode":"xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx","sandbox":"yes"}' --format=json
3. Order A (Source): Create an order, get its ID.
4. Order B (Target): Create another order, get its ID.

7. Expected Results

• The HTTP response should indicate a successful redirection or a success message (depending on successMessage setting).
• The "Target Order" (Order B) status should change from pending to processing or completed in the WooCommerce database.

8. Verification Steps

1. Check Order Status:
   wp wc order get [ORDER_B_ID] --fields=status
   Expected: "processing" or "completed"
2. Check Order Meta:
   wp post meta get [ORDER_B_ID] _zarinpal_authority
   Note: This value will be the ORIGINAL authority for Order B, proving that we successfully used Order A's authority to pay for Order B despite them not matching.

9. Alternative Approaches

If the plugin performs an internal lookup of the order by authority before checking the order_id parameter:

1. Identify if the plugin uses get_posts with meta_query for _zarinpal_authority.
2. If it does, the exploit may require finding a logic branch where the order_id parameter takes precedence over the meta lookup.
3. In version 5.0.16, the vulnerability specifically stems from trusting the order_id in the URL and verifying the Authority in the URL independently.