CVE-2026-101166 · Package
NO FIX YET · SEE WHAT TO DO
The Mollie Payments for WooCommerce WordPress plugin, before version 8.2.0, does not check whether a product is published before creating an order through its PayPal express-checkout endpoint. An unauthenticated visitor can therefore order draft or unpublished products.
first public Nov 4, 2026 · 1 source
Is this in your stack? Find out in 2 minutes.
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
Stores running the Mollie Payments for WooCommerce WordPress plugin before 8.2.0 that use its PayPal express-checkout endpoint. Stores on other payment paths or on a newer plugin version are not described as affected. The sources do not say whether the flaw is reachable on every configuration.
Not affected if plugin-8.2.0-or-later
Who cares mollie, paypal, woocommerce, wordpress
8.2.0 or later.8.2.0 or later (per the description; the sources do not give further detail)The Mollie Payments for WooCommerce WordPress plugin before 8.2.0 does not verify a product's publication status before creating an order for it through its PayPal express-checkout endpoint, allowing unauthenticated users to order draft or unpublished products.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.