{"id":"CVE-2026-122062","kind":"vulnerability","aliases":["CVE-2026-122062"],"related":[],"title":"WordPress Pronamic Pay plugins expose stored form submissions via REST API","description":"The Pronamic Pay WordPress plugin before 11.1.0, Pronamic Pay doneren met Mollie WordPress plugin before 1.7.1 do not restrict access to stored form submissions through the REST API, allowing unauthenticated users to read the messages that visitors submitted through the bundled forms.","summary":"The Pronamic Pay WordPress plugin and the Pronamic Pay doneren met Mollie plugin do not restrict access to stored form submissions through the REST API. An unauthenticated visitor can read messages that other visitors submitted through the bundled forms.","severity":"medium","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["mollie","other","pronamic-pay","wordpress"],"not_affected_if":["patched-version","plugin-not-installed"],"how_to_check":"- Check the installed version of the Pronamic Pay plugin and the Pronamic Pay doneren met Mollie plugin in the WordPress admin plugins list.","fix":"- Pronamic Pay plugin: move to `11.1.0` or later.\n- Pronamic Pay doneren met Mollie plugin: move to `1.7.1` or later.","status":"open","published_at":"2026-11-08T06:17:05+00:00","first_seen_at":"2026-11-08T06:46:21+00:00","triaged_at":"2026-11-08T06:47:15+00:00","updated_at":"2026-11-08T06:47:15+00:00","category":"other","confidence":0.6,"triage":{"at":"2026-11-08T06:47:15Z","model":"claude-haiku-5-5","output":{"fix":"- Pronamic Pay plugin: move to `11.1.0` or later.\n- Pronamic Pay doneren met Mollie plugin: move to `1.7.1` or later.","reach":"internet","title":"WordPress Pronamic Pay plugins expose stored form submissions via REST API","impact":"medium","summary":"The Pronamic Pay WordPress plugin and the Pronamic Pay doneren met Mollie plugin do not restrict access to stored form submissions through the REST API. An unauthenticated visitor can read messages that other visitors submitted through the bundled forms.","audience":"businesses","category":"other","nicknames":[],"who_cares":["wordpress","pronamic-pay","mollie"],"confidence":0.6,"fix_status":"available","needs_auth":"no","worst_case":"visitor messages readable by unauthenticated users","analyst_note":"","how_to_check":"- Check the installed version of the Pronamic Pay plugin and the Pronamic Pay doneren met Mollie plugin in the WordPress admin plugins list.\n- unknown","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["plugin-not-installed","patched-version"],"who_is_affected":"Sites running the Pronamic Pay WordPress plugin or the Pronamic Pay doneren met Mollie plugin with bundled forms that store submissions. Sites without these plugins or without stored form submissions are not exposed.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000724,"input_tokens":4569,"output_tokens":535,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-122062':14A,17A '-2026':13A,16A '1.7.1':78C '11.1.0':69C 'access':40B,82C 'allow':91C 'api':11A,48B,90C 'bundl':61B,103C 'cve':12A,15A 'doneren':33B,72C 'expos':5A 'form':7A,43B,62B,85C,104C 'messag':54B,97C 'met':34B,73C 'molli':18B,35B,74C 'pay':3A,22B,26B,32B,65C,71C 'plugin':4A,28B,36B,67C,76C 'pronam':2A,21B,25B,31B,64C,70C 'pronamic-pay':20B 'read':53B,95C 'rest':10A,47B,89C 'restrict':39B,81C 'store':6A,42B,84C 'submiss':8A,44B,86C 'submit':58B,100C 'unauthent':50B,92C 'user':93C 'via':9A 'visitor':51B,57B,99C 'wordpress':1A,23B,27B,66C,75C","nicknames":[],"mitigations":[],"who_affected":"Sites running the Pronamic Pay WordPress plugin or the Pronamic Pay doneren met Mollie plugin with bundled forms that store submissions. Sites without these plugins or without stored form submissions are not exposed.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["medium","mollie","other","pronamicpay","wordpress"],"campaign_type":null,"search_a":"'-122062':14A,17A '-2026':13A,16A 'api':11A 'cve':12A,15A 'expos':5A 'form':7A 'pay':3A 'plugin':4A 'pronam':2A 'rest':10A 'store':6A 'submiss':8A 'via':9A 'wordpress':1A","search_b":"'access':40B 'api':48B 'bundl':61B 'doneren':33B 'form':43B,62B 'messag':54B 'met':34B 'molli':18B,35B 'pay':22B,26B,32B 'plugin':28B,36B 'pronam':21B,25B,31B 'pronamic-pay':20B 'read':53B 'rest':47B 'restrict':39B 'store':42B 'submiss':44B 'submit':58B 'unauthent':50B 'visitor':51B,57B 'wordpress':23B,27B","search_c":"'1.7.1':78C '11.1.0':69C 'access':82C 'allow':91C 'api':90C 'bundl':103C 'doneren':72C 'form':85C,104C 'messag':97C 'met':73C 'molli':74C 'pay':65C,71C 'plugin':67C,76C 'pronam':64C,70C 'read':95C 'rest':89C 'restrict':81C 'store':84C 'submiss':86C 'submit':100C 'unauthent':92C 'user':93C 'visitor':99C 'wordpress':66C,75C","cause_entry":null,"cause_path":null,"first_public_at":"2026-11-08T06:17:05+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-122062","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-122062","severity":null,"published_at":"2026-11-08T06:17:05+00:00","modified_at":"2026-11-08T06:17:05+00:00","first_seen_at":"2026-11-08T06:46:21+00:00","fetched_at":"2026-11-08T06:46:21+00:00","note":null}],"documents":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}