Skip to content
OpenAdvisories

Product · craftcms

commerce-mollie

1 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

1 result · Clear filters · Feed

  • High 7.5
    CVE-2026-115937

    Unauthenticated payment reuse allows unpaid orders to be marked as paid

    The Mollie webhook endpoint accepts two independent, attacker-controlled parameters and never verifies that they belong together: * commerceTransactionHash — selects which Craft Commerce transaction is completed * id — selects which Mollie payment is queried …

    craftcms commerce-mollie