CVE-2026-101165 in Mollie Payments for WooCommerce Plugin
Summary
by MITRE • 11/04/2026
The Mollie Payments for WooCommerce WordPress plugin before 8.2.0 does not verify an order's payment state or the requested payment gateway before removing a configured payment-surcharge fee, allowing unauthenticated users to reduce an order's total before completing payment.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 11/04/2026
The vulnerability identified in versions of the Mollie Payments for WooCommerce WordPress plugin prior to version 8.2.0 represents a critical business logic flaw that undermines the integrity of e-commerce transactions. This issue stems from insufficient validation mechanisms within the plugin’s codebase, specifically regarding how payment surcharges are calculated and applied during the checkout process. The core technical deficiency lies in the failure to verify two essential components before executing the removal or adjustment of a configured payment-surcharge fee: the current state of the order and the specific payment gateway being utilized by the customer. In a secure implementation, any modification to financial totals must be strictly gated behind authentication checks and rigorous validation against predefined business rules. However, in this vulnerable version, these safeguards are absent, creating an exploitable gap that allows external actors to manipulate transaction values without valid credentials or proper authorization.
From a technical perspective, the flaw enables unauthenticated users to intercept and alter the data payload sent during the checkout sequence. By manipulating the request parameters associated with the payment surcharge logic, attackers can force the system to remove fees that should be permanently attached to specific order states or gateway configurations. This manipulation occurs before the finalization of the payment process, meaning the attacker can reduce the total amount due on an order without needing a valid session token or user account. The absence of server-side verification for the requested payment gateway further exacerbates this risk, as it allows attackers to bypass conditional logic that might otherwise restrict such modifications based on the selected method of payment. This lack of context-aware validation is a fundamental deviation from secure coding practices required for handling financial data in web applications.
The operational impact of this vulnerability is significant for merchants relying on WooCommerce and Mollie Payments. Attackers can exploit this flaw to conduct price manipulation attacks, effectively stealing goods or services by paying less than the intended amount. For instance, if a merchant applies an additional fee for using credit cards via Mollie, an attacker could remove this surcharge before completing the purchase, resulting in direct financial loss equal to the value of the removed fees. In more severe scenarios involving complex pricing structures or dynamic discounts, the potential for abuse increases, potentially allowing attackers to exploit cascading logic errors that affect inventory levels and revenue reporting accuracy. This not only results in immediate monetary losses but also erodes customer trust if fraudulent transactions become prevalent on the platform.
This vulnerability aligns with CWE-20 Improper Input Validation, as the application fails to adequately sanitize or validate user-supplied input before processing it for financial calculations. Furthermore, it relates to CWE-841 Improvement of Enforcement of Business Logic, highlighting a failure in enforcing intended operational rules regarding payment adjustments. In terms of offensive security frameworks, this exploit maps to MITRE ATT&CK technique T1530 Data from Information Repositories or more specifically the broader category of Application Layer Attacks where an adversary manipulates application logic for financial gain. The lack of authentication requirement places it within the scope of unauthenticated exploitation vectors common in poorly secured WordPress plugins that expose sensitive endpoints without adequate access controls.
To mitigate this vulnerability, immediate action is required to update the Mollie Payments for WooCommerce plugin to version 8.2.0 or later, where these validation checks have been implemented. Developers and administrators should ensure that all payment-related logic includes strict server-side verification of order status and gateway selection before any financial adjustments are made. It is also recommended to implement robust input validation and output encoding practices across the entire checkout flow. Additionally, merchants should monitor transaction logs for anomalies in surcharge application or unexpected reductions in order totals, which may indicate attempted exploitation. Regular security audits and adherence to OWASP guidelines for e-commerce applications will help prevent similar logic flaws from being introduced into future updates or custom integrations.