# Mollie Payments for WooCommerce <= 8.1.10 - Unauthenticated Insufficient Verification of Data Authenticity to Order Payment Bypass via Webhook

- **ID:** WPSEC-2026-0826
- **Plugin:** Mollie Payments for WooCommerce (`mollie-payments-for-woocommerce`), https://wordpress.org/plugins/mollie-payments-for-woocommerce/
- **Affected versions:** all versions before 8.1.11
- **Fixed in:** 8.1.11 (Update to 8.1.11 or later.)
- **Severity:** Medium 5.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N)
- **Weakness:** CWE-345
- **Usage among sites WPSec scans:** plugin Low, affected versions Low (as of 2026-10-13)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/mollie-payments-for-woocommerce
- **Fix released:** 2026-10-12
- **Published:** 2026-10-13
- **URL:** https://wpsec.com/vuln/WPSEC-2026-0826/

## Description

The Mollie Payments for WooCommerce plugin for WordPress is vulnerable to Insufficient Verification of Data Authenticity via the payment webhook in all versions up to, and including, 8.1.10. This is due to the webhook handler not checking that the Mollie payment ID it receives was created for the order named in the request. A payment that was not the order's current attempt was rejected only if its status was failed or canceled, so a paid payment that belonged to a different order was accepted. This makes it possible for unauthenticated attackers who know an order's ID and order key, such as an order they placed themselves as a guest, to submit a paid Mollie payment that is no longer linked to any order. One example is a superseded payment attempt on a cheaper order. The target order is then marked as paid without its full amount being paid.

## References

- https://wpsec.com/vuln/WPSEC-2026-0826/
- https://plugins.svn.wordpress.org/mollie-payments-for-woocommerce/tags/8.1.11/
- https://wordpress.org/plugins/mollie-payments-for-woocommerce/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-0826/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.