Sylius Mollie Plugin Vulnerability in Payment Processing
CVE-2026-68500
What is CVE-2026-68500?
The Sylius Mollie Plugin, used for integrating Mollie payment solutions, has a critical flaw in its payment webhook. Before the versions 2.2.8, 3.2.4, and 3.3.1, the webhook endpoint used to update payment statuses accepts id and orderId parameters that are controlled by attackers. This flaw does not check whether the provided Mollie payment ID corresponds to the actual Sylius order, enabling unauthorized users to falsely mark any order as paid without the actual transaction taking place. This security issue poses a significant threat to the integrity of payment processes and requires attention to properly secure payment verification mechanisms.
Affected Version(s)
MolliePlugin < 2.2.8 < 2.2.8
MolliePlugin >= 3.0.0, < 3.2.4 < 3.0.0, 3.2.4
MolliePlugin >= 3.3.0, < 3.3.1 < 3.3.0, 3.3.1