---
id: CVE-2026-101165
title: >-
  Mollie Payments for WooCommerce < 8.2.0 - Unauthenticated Payment Surcharge
  Bypass via update_surcharge_order_pay
summary: >-
  The Mollie Payments for WooCommerce WordPress plugin before 8.2.0 does not
  verify an order's payment state or the requested payment gateway before
  removing a configured payment-surcharge fee, allowing unauthenticated users to
  reduce an o…
severity: low
cvss: 3.7
cvssVector: 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N'
cvssSource: adp
cwe:
  - CWE-862
product: Mollie Payments for WooCommerce
affected:
  - mollie_payments_for_woocommerce < 8.2.0
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-11-04T14:08:04.986642Z'
published: '2026-11-04'
updated: '2026-11-04'
sourceUpdated: '2026-11-04T14:18:23.762Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-101165'
references:
  - url: 'https://wpscan.com/vulnerability/035680b1-abc7-41a7-90e1-e0d053fccf30/'
tags:
  - cve.org
epss: 0.00192
epssPercentile: 0.08947
ingestedAt: '2026-11-05T21:36:00.378Z'
---

## Overview

The Mollie Payments for WooCommerce WordPress plugin before 8.2.0 does not verify an order's payment state or the requested payment gateway before removing a configured payment-surcharge fee, allowing unauthenticated users to reduce an order's total before completing payment.

## Affected

- `mollie_payments_for_woocommerce < 8.2.0`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.