CVE-2026-115937
The Mollie webhook endpoint accepts two independent, attacker-controlled parameters and never…
- Risk score
- 53/100
- CVSS
- 7.5 v3.1
- Exploit chance (30 days)
- 0.2%
- Published
- 23 Oct 2026
Open in the live forecast Today's forecast
What to know
- What it is
- The Mollie webhook endpoint accepts two independent, attacker-controlled parameters and never verifies that they belong together: commerceTransactionHash — selects which Craft Commerce transaction is completed id — selects which Mollie payment is queried for its status An unauthenticated attacker holding any paid Moll…
- Affected
- See advisory
- Fix
- Apply the vendor's security update; see the linked advisory.
- Exploitation
- No known exploitation
Why it is Yellow
- CVSS 7.5 high
- Remotely exploitable without logging in
References
Original description
The Mollie webhook endpoint accepts two independent, attacker-controlled parameters and never verifies that they belong together: * commerceTransactionHash — selects which Craft Commerce transaction is completed * id — selects which Mollie payment is queried for its status An unauthenticated attacker holding any paid Mollie payment ID from the merchant’s account can pair it with any transaction hash. Commerce queries Mollie, sees status: paid, and marks the target transaction successful for that transaction’s full amount, regardless of how much was actually paid.
Last activity 23 Oct 2026. Patch Forecast updates every hour.