CVE-2026-101166 in Mollie Payments for WooCommerce Plugin
Summary
by MITRE • 11/04/2026
The Mollie Payments for WooCommerce WordPress plugin before 8.2.0 does not verify a product's publication status before creating an order for it through its PayPal express-checkout endpoint, allowing unauthenticated users to order draft or unpublished products.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 11/04/2026
The vulnerability identified in the Mollie Payments for WooCommerce WordPress plugin prior to version 8.2.0 represents a critical failure in access control and input validation within the e-commerce transaction workflow. This flaw specifically affects the PayPal Express Checkout endpoint, which serves as an interface between the external payment processor and the internal order management system of the WordPress site. The core technical deficiency lies in the absence of verification regarding the publication status of products before initiating the creation of a new order. In standard WooCommerce operations, draft or unpublished products are intended to be invisible to customers and inaccessible for purchase through public-facing interfaces. However, due to this oversight, the plugin fails to enforce these visibility constraints when processing requests via the PayPal integration layer.
From an attacker's perspective, this lack of server-side validation allows unauthenticated users to bypass standard storefront restrictions. By manipulating API calls or exploiting the endpoint directly, a malicious actor can specify product identifiers associated with draft or unpublished items. Since the plugin does not cross-reference these identifiers against the database records for publication status before proceeding with order creation, it accepts and processes transactions for products that should remain inaccessible. This behavior effectively exposes internal inventory data and allows for the purchase of items that are typically reserved for administrative review or future release. The vulnerability stems from a fundamental principle violation in secure software design where trust is placed in client-side inputs without sufficient server-side verification of business logic constraints, such as product visibility rules defined by the content management system.
The operational impact of this vulnerability extends beyond simple unauthorized access to unpublished goods. It compromises the integrity of sales data and inventory tracking systems within WooCommerce. Orders generated through this method may not appear correctly in standard administrative dashboards if they rely on publication status for display logic, leading to discrepancies between financial records recorded by Mollie or PayPal and the actual order history visible to store administrators. Furthermore, it poses a risk to business strategy by allowing premature sales of products that are intended for future launch, potentially causing customer confusion regarding product availability or delivery timelines. In severe cases, if draft products contain sensitive internal information in their metadata or descriptions, this could lead to unintended data exposure, although the primary impact remains on transactional integrity and access control enforcement.
To mitigate this vulnerability, administrators must upgrade the Mollie Payments for WooCommerce plugin to version 8.2.0 or later, where the developers have implemented proper checks to verify product publication status before processing orders through the PayPal Express Checkout endpoint. Until an update is applied, site owners should consider disabling the PayPal Express Checkout option if it is not strictly necessary, thereby removing the attack vector entirely. Additionally, implementing web application firewalls with rules that detect anomalous API requests targeting unpublished post types can provide a layer of defense in depth. Regular security audits and code reviews focusing on input validation for e-commerce plugins are essential to prevent similar logic flaws where business rules regarding content visibility are not enforced at every stage of the transaction pipeline. This incident underscores the importance of treating all external endpoints with equal scrutiny, ensuring that access controls applied to standard web pages are equally rigorous when handling programmatic API requests from third-party payment processors.