CVE-2026-101165 · Package
NO FIX YET · SEE WHAT TO DO
The Mollie Payments for WooCommerce WordPress plugin, before version 8.2.0, does not check an order's payment state or the requested gateway before removing a payment surcharge fee. An unauthenticated visitor can therefore reduce an order's total before paying.
first public Nov 4, 2026 · 1 source
Is this in your stack? Find out in 2 minutes.
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
WooCommerce stores running the Mollie Payments plugin before 8.2.0 that configure a payment-surcharge fee are exposed, because the plugin removes that fee without verifying the order. Stores without a surcharge configured or running a fixed version can skip it. The sources do not describe the exact request path.
Not affected if no-payment-surcharge, version-8.2.0-or-later
Who cares mollie, payments, woocommerce, wordpress
8.2.0 are affected8.2.0 or laterThe Mollie Payments for WooCommerce WordPress plugin before 8.2.0 does not verify an order's payment state or the requested payment gateway before removing a configured payment-surcharge fee, allowing unauthenticated users to reduce an order's total before completing payment.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.