Unauthenticated payment reuse allows unpaid orders to be marked as paid


Report #HCKRT-6RB2BC in Craft CMS Vulnerability Disclosure Program

Disclosed Report
StatusClosed
Resolved
TargetTier 1
Other Craft plugins
Severity
High
Details
Program
Craft CMS Vulnerability Disclosure Program
Target
Other Craft plugins
Creation Date
9/18/2026 7:38:35 PM
Severity
High
CVSS Score

None

CVE Number
CVE-2026-115937
Affected versions
>= 2.1.1, < 4.4.3
Visibility
Disclosed
Disclosed at
10/23/2026 9:42:45 PM
Author
@ouribe
Status
Resolved (Closed)
Vulnerability Type (CAPEC™)
Exploitation of Trusted Identifiers
Weakness (CWE)
(CWE-345) Insufficient Verification of Data Authenticity
Summary

Unauthenticated payment reuse allows unpaid orders to be marked as paid

Description

The Mollie webhook endpoint accepts two independent, attacker-controlled parameters and never verifies that they belong together:

commerceTransactionHash — selects which Craft Commerce transaction is completed id — selects which Mollie payment is queried for its status An unauthenticated attacker holding any paid Mollie payment ID from the merchant’s account can pair it with any transaction hash.

Commerce queries Mollie, sees status: paid, and marks the target transaction successful for that transaction’s full amount, regardless of how much was actually paid.

Impact

Financial loss. Goods and services are released without payment. Nothing in the Commerce UI signals a discrepancy.

Timeline

Reporter

Created.

Friday, September 18, 2026 7:38 PM
Luke

Severity changed from High to Medium

Tuesday, September 22, 2026 7:08 AM
Luke

Severity changed from Medium to High

Tuesday, September 22, 2026 7:08 AM
angrybrad

Changed to Accepted (Open)

Tuesday, September 22, 2026 5:17 PM
angrybrad

Changed to Resolved (Closed).

Thanks for the report.

We’ve just released 4.4.3 with a fix.

https://github.com/craftcms/commerce-mollie/security/advisories/GHSA-3qcx-mjf6-48vj has been created for this and will be made public in ~30 days.

Wednesday, September 23, 2026 6:11 PM
Hackrate

Our platform helps companies to identify software vulnerabilities in a cost-efficient way. It provides a secure and centralized view of ethical hacking projects for your company.

US Patent Applied for HackGATE #63/645,845

Checking service status...
Company
Products
From the Blog
Hackrate is ISO 27001 certified

Hackrate Ethical Hacking Platform |
2026 ©

CVE Program Numbering Authority