Mollie Payments for WooCommerce <= 8.1.10 - Unauthenticated Insufficient Verification of Data Authenticity to Order Payment Bypass via Webhook
- ID
- WPSEC-2026-0826
- Plugin
- Mollie Payments for WooCommerce (mollie-payments-for-woocommerce)
- Affected
- all versions before 8.1.11
- Remediation
- Update to 8.1.11 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
- Weakness
- CWE-345
- Usage
- Plugin Low · Affected versions Low among sites WPSec scans, 2026-10-13
- Attack surface
- Mollie Payments for WooCommerce on WPSec AttackSurface
- Fix released
- Published
Description
The Mollie Payments for WooCommerce plugin for WordPress is vulnerable to Insufficient Verification of Data Authenticity via the payment webhook in all versions up to, and including, 8.1.10. This is due to the webhook handler not checking that the Mollie payment ID it receives was created for the order named in the request. A payment that was not the order's current attempt was rejected only if its status was failed or canceled, so a paid payment that belonged to a different order was accepted. This makes it possible for unauthenticated attackers who know an order's ID and order key, such as an order they placed themselves as a guest, to submit a paid Mollie payment that is no longer linked to any order. One example is a superseded payment attempt on a cheaper order. The target order is then marked as paid without its full amount being paid.
References
- https://wpsec.com/vuln/WPSEC-2026-0826/
- https://plugins.svn.wordpress.org/mollie-payments-for-woocommerce/tags/8.1.11/
- https://wordpress.org/plugins/mollie-payments-for-woocommerce/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS