Recommended action window: Monitor and triage in normal cycle
NVD description
The Mollie webhook endpoint accepts two independent, attacker-controlled parameters and never verifies that they belong together: * commerceTransactionHash — selects which Craft Commerce transaction is completed * id — selects which Mollie payment is queried for its status An unauthenticated attacker holding any paid Mollie payment ID from the merchant’s account can pair it with any transaction hash. Commerce queries Mollie, sees status: paid, and marks the target transaction successful for that transaction’s full amount, regardless of how much was actually paid.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
NONE
🚨 CVE-2026-115937 (7.5) 🚨 Craft Commerce sites that take payments through Mollie let anyone mark an unpaid order as paid in full. Only sites that take Mollie payments through Craft Commerce are affected. No fixed version is named. https://t.co/g8ZnZeuXUi