CVE-2026-101166: Mollie Payments for WooCommerce < 8.2.0 - Unauthenticated Unpublished Product Purchase via mollie_paypal_create_order
The Mollie Payments for WooCommerce WordPress plugin before 8.2.0 does not verify a product's publication status before creating an order for it through its PayPal express-checkout endpoint, allowing unauthenticated users to order draft or unpublished products.
Event History
Frequently Asked Questions
Who is exposed to this issue?
WordPress sites using Mollie Payments for WooCommerce versions before 8.2.0 are affected. The exposed functionality is the plugin's PayPal express-checkout order-creation endpoint.
Does an attacker need an account or interaction from a site user?
No. The issue can be exploited by an unauthenticated user, and the supplied vector indicates it is reachable over the network without user interaction. Exploitation has high attack complexity.
What is the impact of successful exploitation?
An attacker can create orders for products that are drafts or otherwise unpublished. The provided impact assessment indicates integrity impact only, with no confidentiality or availability impact.
What version addresses the issue?
Update Mollie Payments for WooCommerce to version 8.2.0 or later. Versions before 8.2.0 do not verify publication status when creating orders through the affected endpoint.