{"id":"CVE-2026-101165","aliases":["EUVD-2026-116758","GHSA-j7f4-8r42-xxhj"],"status":"published","title":"Mollie Payments for WooCommerce \u003c 8.2.0 - Unauthenticated Payment Surcharge Bypass via update_surcharge_order_pay","description":"The Mollie Payments for WooCommerce WordPress plugin before 8.2.0 does not verify an order's payment state or the requested payment gateway before removing a configured payment-surcharge fee, allowing unauthenticated users to reduce an order's total before completing payment.","severity":{"version":"3.1","score":3.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"low","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-10","score":0.00192,"percentile":0.08957,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-862"],"published":"2026-11-04T06:00:23Z","modified":"2026-11-04T14:18:23Z","products":[{"vendor":"mollie","product":"mollie payments for woocommerce"},{"vendor":"unknown","product":"mollie payments for woocommerce"}],"references":[{"url":"https://wpscan.com/vulnerability/035680b1-abc7-41a7-90e1-e0d053fccf30/","tags":["exploit","vdb-entry","technical-description"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-101165"},{"url":"https://wpscan.com/vulnerability/035680b1-abc7-41a7-90e1-e0d053fccf30"},{"url":"https://github.com/advisories/GHSA-j7f4-8r42-xxhj"}],"sources":{"cve":[{"id":"CVE-2026-101165","title":"Mollie Payments for WooCommerce \u003c 8.2.0 - Unauthenticated Payment Surcharge Bypass via update_surcharge_order_pay","description":"The Mollie Payments for WooCommerce WordPress plugin before 8.2.0 does not verify an order's payment state or the requested payment gateway before removing a configured payment-surcharge fee, allowing unauthenticated users to reduce an order's total before completing payment.","status":"published","published":"2026-11-04T06:00:23.493Z","modified":"2026-11-04T14:18:23.762Z","cvss":[{"version":"3.1","score":3.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"low","assessor":"adp"}],"cwes":["CWE-862"],"updated_at":"2026-11-04T15:32:52.167772Z"}],"euvd":[{"id":"EUVD-2026-116758","description":"The Mollie Payments for WooCommerce WordPress plugin before 8.2.0 does not verify an order's payment state or the requested payment gateway before removing a configured payment-surcharge fee, allowing unauthenticated users to reduce an order's total before completing payment.","status":"published","published":"2026-11-04T06:00:23Z","modified":"2026-11-04T14:18:23Z","cvss":[{"version":"3.1","score":3.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"low"}],"updated_at":"2026-11-04T15:09:08.966365Z"}],"ghsa":[{"id":"GHSA-j7f4-8r42-xxhj","title":"The Mollie Payments for WooCommerce WordPress plugin before 8.2.0 does not verify an order's...","description":"The Mollie Payments for WooCommerce WordPress plugin before 8.2.0 does not verify an order's payment state or the requested payment gateway before removing a configured payment-surcharge fee, allowing unauthenticated users to reduce an order's total before completing payment.","status":"published","published":"2026-11-04T06:32:57Z","modified":"2026-11-04T15:32:24Z","cvss":[{"version":"3.1","score":3.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"low"}],"cwes":["CWE-862"],"updated_at":"2026-11-04T15:52:08.140959Z"}],"nvd":[{"id":"CVE-2026-101165","description":"The Mollie Payments for WooCommerce WordPress plugin before 8.2.0 does not verify an order's payment state or the requested payment gateway before removing a configured payment-surcharge fee, allowing unauthenticated users to reduce an order's total before completing payment.","status":"published","published":"2026-11-04T06:16:56.88Z","modified":"2026-11-04T15:17:22.463Z","cvss":[{"version":"3.1","score":3.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"low","assessor":"secondary"}],"cwes":["CWE-862"],"updated_at":"2026-11-04T18:06:26.923818Z"}]}}