PT-2026-136842
CVE-2026-101166
·
Published
2026-11-04
·
Updated
2026-11-04
Description by
CVSS 3.1
3.7
LowMetricsAV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N
The Mollie Payments for WooCommerce WordPress plugin before 8.2.0 does not verify a product's publication status before creating an order for it through its PayPal express-checkout endpoint, allowing unauthenticated users to order draft or unpublished products.
Exploitability
Exploit
Fix
Impacts
Researchers
Vendors
Affected products
Found an issue in the description? Have something to add? Feel free to write us 👾