CVE-2026-101166

LowCVSS 3.7/10Last modified Nov 4, 2026

Description

The Mollie Payments for WooCommerce WordPress plugin before 8.2.0 does not verify a product's publication status before creating an order for it through its PayPal express-checkout endpoint, allowing unauthenticated users to order draft or unpublished products.

Metrics

CVSS 3.1 3.7/10CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N

Weakness enumeration

CWE-862

Affected software

VendorProductVersions
UnknownMollie Payments for WooCommerce< 8.2.0

References

Timeline

Published
Nov 4, 2026
Last modified
Nov 4, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-1011686.2GitLab has remediated an issue in GitLab CE/EE affecting all versions from 12.0 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 thCVE-2026-1011698.7In affected versions of Octopus Server, an authenticated user with permissions to edit an Environment or Project can set specifically crafteCVE-2026-101174.3A weakness has been identified in Open5GS up to 2.7.7. This issue affects the function ogs_pool_id_calloc in the library /lib/sbi/nghttp2-seCVE-2026-1011704.0DoS vulnerability in the file parsing module. Impact: Successful exploitation of this vulnerability may affect availability.CVE-2026-1011713.6Permission control vulnerability in the background task management module. Impact: Successful exploitation of this vulnerability may affect CVE-2026-1011726.2Permission control vulnerability in the graphics module. Impact: Successful exploitation of this vulnerability may affect confidentiality.CVE-2026-1011736.5DoS vulnerability in the DSoftBus module. Impact: Successful exploitation of this vulnerability may affect availability.CVE-2026-1011745.7DoS vulnerability in the DSoftBus module. Impact: Successful exploitation of this vulnerability may affect availability.CVE-2026-1011754.3Null pointer dereference vulnerability in the ArkWeb module. Impact: Successful exploitation of this vulnerability may affect availability.CVE-2026-1011767.1Permission control vulnerability in the event notification management module. Impact: Successful exploitation of this vulnerability may affeCVE-2026-1011773.7Permission control vulnerability in the Optimizer module. Impact: Successful exploitation of this vulnerability may affect service confidentCVE-2026-1011786.6Permission control vulnerability in the autofill service module. Impact: Successful exploitation of this vulnerability may affect service co
CVE-2026-101166: Low severity, CVSS 3.7 | Vulnix