CVE-2026-101166

The Mollie Payments for WooCommerce WordPress plugin before 8.2.0 does not verify a product's publication status before creating an order for it through its PayPal express-checkout endpoint, allowing unauthenticated users to order draft or unpublished products...

CVE-2026-101165

The Mollie Payments for WooCommerce WordPress plugin before 8.2.0 does not verify an order's payment state or the requested payment gateway before removing a configured payment-surcharge fee, allowing unauthenticated users to reduce an order's total before completing payment...

WordPress Mollie Payments for WooCommerce plugin < 8.2.0 - Unauthenticated Payment Surcharge Bypass vulnerability

Unauthenticated Payment Surcharge Bypass vulnerability discovered by whp-wessel in WordPress Plugin Mollie Payments for WooCommerce versions 8.2.0...

CVE-2026-101165 Mollie Payments for WooCommerce < 8.2.0 - Unauthenticated Payment Surcharge Bypass via update_surcharge_order_pay

The Mollie Payments for WooCommerce WordPress plugin before 8.2.0 does not verify an order's payment state or the requested payment gateway before removing a configured payment-surcharge fee, allowing unauthenticated users to reduce an order's total before completing payment...

EUVD-2026-116758

The Mollie Payments for WooCommerce WordPress plugin before 8.2.0 does not verify an order's payment state or the requested payment gateway before removing a configured payment-surcharge fee, allowing unauthenticated users to reduce an order's total before completing payment...

CVE-2026-101166

The Mollie Payments for WooCommerce WordPress plugin, in versions prior to 8.2.0 , is vulnerable to an unauthenticated unpublished product purchase . The root cause is that the plugin fails to verify a product's publication status when creating an order through its PayPal express-checkout endpoin...

CVE-2026-101166 Mollie Payments for WooCommerce < 8.2.0 - Unauthenticated Unpublished Product Purchase via mollie_paypal_create_order

The Mollie Payments for WooCommerce WordPress plugin before 8.2.0 does not verify a product's publication status before creating an order for it through its PayPal express-checkout endpoint, allowing unauthenticated users to order draft or unpublished products...

WordPress Mollie Payments for WooCommerce plugin < 8.2.0 - Unauthenticated Unpublished Product Purchase vulnerability

Unauthenticated Unpublished Product Purchase vulnerability discovered by whp-wessel in WordPress Plugin Mollie Payments for WooCommerce versions 8.2.0...

CVE-2026-101165

The Mollie Payments for WooCommerce WordPress plugin, in versions before 8.2.0 , contains an unauthenticated payment surcharge bypass vulnerability. The flaw occurs because the plugin fails to verify an order's payment state or the requested payment gateway before removing a configured payment-su...

EUVD-2026-116759

The Mollie Payments for WooCommerce WordPress plugin before 8.2.0 does not verify a product's publication status before creating an order for it through its PayPal express-checkout endpoint, allowing unauthenticated users to order draft or unpublished products...

EUVD-2026-109205

The Mollie webhook endpoint accepts two independent, attacker-controlled parameters and never verifies that they belong together: commerceTransactionHash — selects which Craft Commerce transaction is completed id — selects which Mollie payment is queried for its status An unauthenticated attacker...

CVE-2026-115937

The Mollie webhook endpoint accepts two independent, attacker-controlled parameters and never verifies that they belong together: commerceTransactionHash — selects which Craft Commerce transaction is completed id — selects which Mollie payment is queried for its status An unauthenticated attacker...

CVE-2026-115937 Unauthenticated payment reuse allows unpaid orders to be marked as paid

The Mollie webhook endpoint accepts two independent, attacker-controlled parameters and never verifies that they belong together: commerceTransactionHash — selects which Craft Commerce transaction is completed id — selects which Mollie payment is queried for its status An unauthenticated attacker...

CVE-2026-115937

The Mollie webhook endpoint accepts two independent, attacker-controlled parameters and never verifies that they belong together: commerceTransactionHash — selects which Craft Commerce transaction is completed id — selects which Mollie payment is queried for its status An unauthenticated attacker...

CVE-2026-115937

The Mollie webhook endpoint in Craft Commerce is vulnerable to an unauthenticated payment reuse flaw due to insufficient verification of data authenticity (CWE-345). The application fails to verify that the commerceTransactionHash and id parameters belong together. An unauthenticated attacker pos...

CVE-2026-115937 Unauthenticated payment reuse allows unpaid orders to be marked as paid

The Mollie webhook endpoint accepts two independent, attacker-controlled parameters and never verifies that they belong together: commerceTransactionHash — selects which Craft Commerce transaction is completed id — selects which Mollie payment is queried for its status An unauthenticated attacker...

CVE-2026-115937 Unauthenticated payment reuse allows unpaid orders to be marked as paid

The Mollie webhook endpoint accepts two independent, attacker-controlled parameters and never verifies that they belong together: commerceTransactionHash — selects which Craft Commerce transaction is completed id — selects which Mollie payment is queried for its status An unauthenticated attacker...

PT-2026-122242

Name of the Vulnerable Software and Affected Versions Craft Commerce affected versions not specified Description The Mollie webhook endpoint allows an unauthenticated attacker to mark an unpaid order as paid in full. This occurs because the endpoint accepts two independent, attacker-controlled...

Craft CMS Mollie for Craft Commerce input validation error vulnerability

Versions 2.1.1 through 4.4.3 of Craft CMS Mollie for Craft Commerce contain an input validation error vulnerability. This flaw arises because the Mollie webhook endpoint fails to verify whether the commerceTransactionHash and id parameters match. As a result, unauthenticated attackers can pair an...

CVE-2026-18467

The Paytium: Mollie payment forms & donations plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 5.0.3. The 5.0.3 patch introduced a wphash/hashequals signature gate on the pt-paytium-user-data field, but left a second filter — ptcfcheckoutmeta,...