CVE-2026-101165: Mollie Payments for WooCommerce < 8.2.0 - Unauthenticated Payment Surcharge Bypass via update_surcharge_order_pay
The Mollie Payments for WooCommerce WordPress plugin before 8.2.0 does not verify an order's payment state or the requested payment gateway before removing a configured payment-surcharge fee, allowing unauthenticated users to reduce an order's total before completing payment.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Mollie Payments for WooCommerceto a version that resolves this vulnerability.Fixed in 8.2.0
Event History
Frequently Asked Questions
Who is exposed to this issue?
WooCommerce stores using Mollie Payments for WooCommerce versions earlier than 8.2.0 are affected if they have configured payment-surcharge fees on orders.
What does an attacker need to exploit it?
The issue can be exploited without authentication or user interaction over the network. Exploitation requires the attacker to target an order where a configured payment surcharge can be removed before payment is completed.
What is the impact of a successful exploit?
An attacker can reduce an order total by removing a configured payment-surcharge fee before completing payment. The provided impact information indicates an integrity impact, with no confidentiality or availability impact.
What should be done if immediate patching is not possible?
The provided data does not specify a workaround. Until the plugin is updated to 8.2.0 or later, review orders for missing payment-surcharge fees and consider disabling configured payment surcharges if they are not essential.
How can administrators check for possible exploitation?
Review unpaid and completed orders for cases where an expected configured payment-surcharge fee is absent or where the order total was reduced before payment. The available data does not identify specific logs, request patterns, or indicators for confirming exploitation.