craftcms/commerce-mollie vulnerabilities

CVEs whose affected-version data names the craftcms/commerce-mollie package. Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.

1 CVERSS

CVE-2026-115937High· 7.5

yesterday

Unauthenticated payment reuse allows unpaid orders to be marked as paid

The Mollie webhook endpoint accepts two independent, attacker-controlled parameters and never verifies that they belong together: * commerceTransactionHash — selects which Craft Commerce transaction is completed * id — selects whi…

▾ Twilightcraftcms · craftcms/commerce-mollievia CVEORG