{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/cpes/cpe2.3amolliecraft_commerce/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:mollie:craft_commerce:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":7.5,"id":"CVE-2026-115937"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Craft Commerce (Mollie integration)"],"_cs_severities":["high"],"_cs_tags":["web-application","authentication-bypass","commerce-vulnerability"],"_cs_type":"advisory","_cs_vendors":["Mollie"],"content_html":"\u003cp\u003eThe Mollie integration for Craft Commerce contains a critical flaw (CVE-2026-115937) in its webhook endpoint. The endpoint fails to verify that the \u003ccode\u003ecommerceTransactionHash\u003c/code\u003e and \u003ccode\u003eid\u003c/code\u003e parameters are cryptographically or logically bound to each other. An unauthenticated attacker possessing a valid Mollie payment ID from the merchant's account can pair it with the transaction hash of any other pending order. The system queries Mollie for the status of the supplied payment ID, receives a 'paid' status, and subsequently marks the target transaction as fully paid, regardless of the actual amount remitted.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows for improper order fulfillment by enabling attackers to complete transactions without submitting valid payment for those specific orders. This can result in unauthorized receipt of goods or services.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eIdentify all instances of Craft Commerce utilizing the Mollie integration.\u003c/li\u003e\n\u003cli\u003eAudit webhook traffic logs for recurring patterns of mismatched transaction hashes and payment IDs.\u003c/li\u003e\n\u003cli\u003eMonitor for and apply patches provided by the plugin maintainers to enforce parameter validation between the transaction hash and the payment ID.\u003c/li\u003e\n\u003cli\u003eReview commerce logs for transactions marked as 'paid' that lack corresponding legitimate payment records.\u003c/li\u003e\n\u003c/ol\u003e\n","date_modified":"2026-10-24T00:03:43Z","date_published":"2026-10-24T00:03:43Z","id":"https://feed.craftedsignal.io/briefs/2026-10-mollie-craft-commerce-auth-bypass/","summary":"An authentication bypass vulnerability in the Craft Commerce Mollie integration allows unauthenticated attackers to mark arbitrary transactions as paid by manipulating webhook parameters.","title":"Mollie Craft Commerce webhook authentication bypass (CVE-2026-115937)","url":"https://feed.craftedsignal.io/briefs/2026-10-mollie-craft-commerce-auth-bypass/"}],"language":"en","title":"CraftedSignal Threat Feed - Cpe:2.3:a:mollie:craft_commerce:*:*:*:*:*:*:*:*","version":"https://jsonfeed.org/version/1.1"}