---
id: "CVE-2026-122062"
page: "https://infrastack.ai/live/CVE-2026-122062"
kind: "vulnerability"
aliases: ["CVE-2026-122062"]
title: "WordPress Pronamic Pay plugins expose stored form submissions via REST API"
severity: "medium"
cvss: null
epss: null
exploited: false
status: "open"
category: "other"
products: []
ecosystems: []
tags: ["mollie", "other", "pronamic-pay", "wordpress"]
not_affected_if: ["patched-version", "plugin-not-installed"]
published_at: "2026-11-08T06:17:05+00:00"
first_seen_at: "2026-11-08T06:46:21+00:00"
updated_at: "2026-11-08T06:47:15+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-122062", "first_seen_at": "2026-11-08T06:46:21+00:00"}]
exploit_sources: []
---

# WordPress Pronamic Pay plugins expose stored form submissions via REST API

Link for people: https://infrastack.ai/live/CVE-2026-122062 (this .md is for agents)

The Pronamic Pay WordPress plugin and the Pronamic Pay doneren met Mollie plugin do not restrict access to stored form submissions through the REST API. An unauthenticated visitor can read messages that other visitors submitted through the bundled forms.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed version of the Pronamic Pay plugin and the Pronamic Pay doneren met Mollie plugin in the WordPress admin plugins list.

## Fix

- Pronamic Pay plugin: move to `11.1.0` or later.
- Pronamic Pay doneren met Mollie plugin: move to `1.7.1` or later.

## Timeline

- 2026-11-08T06:46:21+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-122062

## From the sources

The Pronamic Pay WordPress plugin before 11.1.0, Pronamic Pay doneren met Mollie WordPress plugin before 1.7.1 do not restrict access to stored form submissions through the REST API, allowing unauthenticated users to read the messages that visitors submitted through the bundled forms.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_