Improper Input Validation in Mollie Payments for WooCommerce Plugin by WordPress
CVE-2026-101166

Currently unrated

Key Information:

Vendor

WordPress
Status
Mollie Payments For WooCommerce
Vendor
CVE Published:
4 November 2026

Badges

👾 Exploit Exists🟡 Public PoC

What is CVE-2026-101166?

The Mollie Payments for WooCommerce plugin prior to version 8.2.0 exhibits a flaw in its validation process, allowing unauthenticated users to create orders for products that are either in draft status or unpublished. This security loophole arises specifically through the PayPal express-checkout endpoint, posing risks for product management and revenue integrity within e-commerce stores.

Affected Version(s)

Mollie Payments for WooCommerce 0 < 8.2.0

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2026-101166 - Proof of Concept

References

https://wpscan.com/vulnerability/67794161-4243-4587-819c-...
exploitvdb-entrytechnical-description

Timeline

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

Credit

whp-wessel
WPScan
.