Craft Commerce Mollie plugin: Payment status forgery via webhook
Summary
The Mollie webhook of the commerce-mollie plugin for Craft Commerce accepts a transaction hash and a Mollie payment ID without checking that they belong together. An unauthenticated attacker who holds any paid Mollie payment ID from the merchant's account can pair it with another transaction and have that transaction marked as successful for its full amount, regardless of the amount actually paid. The main risk is goods or services being released for unpaid orders.
Affected
- commerce-mollie versions 2.1.1 to before 4.4.3 (per CNA data; VulDB lists up to 4.4.2)
Fixed in
- Upgrade to commerce-mollie 4.4.3 or later
Workaround
- Unknown. No vendor workaround documented.
- Interim check: compare recent orders marked as paid with the amounts received at Mollie and reconcile order states against the Mollie dashboard.
Exploitation
- No confirmed in-the-wild exploitation found.
- No public proof of concept according to The Hacker Wire; another source lists an unclear PoC value.
- Not listed in CISA KEV.
Our recommendation
- Check whether any Craft Commerce shop uses the Mollie gateway.
- Update commerce-mollie to 4.4.3 or later as a priority.
- Reconcile paid orders against Mollie payments and review any order whose payment reference does not match.
- Monitor order and payment logs for webhook calls with unexpected transaction references.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- GitHub Security Advisory GHSA-3qcx-mjf6-48vj github.com
- commerce-mollie release 4.4.3 github.com
- commerce-mollie repository github.com
- HCKRT advisory www.hckrt.com
- OSV entry CVE-2026-115937 osv.dev
- VulDB entry 426046 vuldb.com
- Canadian Centre for Cyber Security AV26-1086 www.cyber.gc.ca
- Tenable CVE-2026-115937 www.tenable.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 00:23.
Original description (NVD)
The Mollie webhook endpoint accepts two independent, attacker-controlled parameters and never verifies that they belong together: * commerceTransactionHash — selects which Craft Commerce transaction is completed * id — selects which Mollie payment is queried for its status An unauthenticated attacker holding any paid Mollie payment ID from the merchant’s account can pair it with any transaction hash. Commerce queries Mollie, sees status: paid, and marks the target transaction successful for that transaction’s full amount, regardless of how much was actually paid.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.