CVE-2026-122062: Pronamic Pay & Pronamic Pay doneren met Mollie - Unauthenticated Form Submission Disclosure via REST API
Published Nov 8, 2026
·Updated
The Pronamic Pay WordPress plugin before 11.1.0, Pronamic Pay doneren met Mollie WordPress plugin before 1.7.1 do not restrict access to stored form submissions through the REST API, allowing unauthenticated users to read the messages that visitors submitted through the bundled forms.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Pronamic Pay WordPress pluginto a version that resolves this vulnerability.Fixed in 11.1.0 - Upgrade
Upgrade
Pronamic Pay doneren met Mollie WordPress pluginto a version that resolves this vulnerability.Fixed in 1.7.1
Event History
Nov 8, 2026
CVE Published
via MITRE·06:00 AM
Data Sourced
via MITRE·06:00 AM
DescriptionWeakness
Data Sourced
via NVD·06:17 AM
Description