Skip to content
Sign in
3.7 Low

CVE-2026-101166 Mollie Payments for WooCommerce < 8.2.0 - Unauthenticated Unpublished Product Purchase via mollie_paypal_create_order

Description

The Mollie Payments for WooCommerce WordPress plugin before 8.2.0 does not verify a product's publication status before creating an order for it through its PayPal express-checkout endpoint, allowing unauthenticated users to order draft or unpublished products.

CVSS 3.1 detail

Vector CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N

Exploitable remotely over the network, without an account and without any user action; the impact on data or service is limited.

Attack vector
Network
Attack complexity
High
Privileges required
None
Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
Low
Availability
None

Affected products and versions

Product Affected versions Fixed in
Mollie Payments for WooCommerce 8.2 earliest → < 8.2.0 8.2.0

Other CVEs of Mollie Payments for WooCommerce

The 2 CVEs of Mollie Payments for WooCommerce →
CVE-2026-101165 Mollie Payments for WooCommerce < 8.2.0 - Unauthenticated Payment Surcharge Bypass via update_surcharge_order_pay 3.7 Low
Track this CVE