---
id: "CVE-2026-101165"
kind: "vulnerability"
aliases: ["CVE-2026-101165"]
title: "Mollie Payments for WooCommerce: unauthenticated users can lower order totals before payment"
severity: "medium"
cvss: null
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["mollie", "package", "payments", "woocommerce", "wordpress"]
not_affected_if: ["no-payment-surcharge", "version-8.2.0-or-later"]
published_at: "2026-11-04T06:16:56+00:00"
first_seen_at: "2026-11-04T06:25:17+00:00"
updated_at: "2026-11-04T06:26:40+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-101165", "first_seen_at": "2026-11-04T06:25:17+00:00"}]
---

# Mollie Payments for WooCommerce: unauthenticated users can lower order totals before payment

The Mollie Payments for WooCommerce WordPress plugin, before version 8.2.0, does not check an order's payment state or the requested gateway before removing a payment surcharge fee. An unauthenticated visitor can therefore reduce an order's total before paying.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed version of the Mollie Payments for WooCommerce plugin in the WordPress admin under Plugins; versions before `8.2.0` are affected
- Confirm whether the store uses a payment-surcharge fee on Mollie gateways, since the flaw concerns removing that fee

## Fix

- Mollie Payments for WooCommerce: move to `8.2.0` or later

## Timeline

- 2026-11-04T06:25:17+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-101165

## From the sources

The Mollie Payments for WooCommerce WordPress plugin before 8.2.0 does not verify an order's payment state or the requested payment gateway before removing a configured payment-surcharge fee, allowing unauthenticated users to reduce an order's total before completing payment.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_