---
id: CVE-2026-101166
title: >-
  Mollie Payments for WooCommerce < 8.2.0 - Unauthenticated Unpublished Product
  Purchase via mollie_paypal_create_order
summary: >-
  The Mollie Payments for WooCommerce WordPress plugin before 8.2.0 does not
  verify a product's publication status before creating an order for it through
  its PayPal express-checkout endpoint, allowing unauthenticated users to order
  draft …
severity: low
cvss: 3.7
cvssVector: 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N'
cvssSource: adp
cwe:
  - CWE-862
product: Mollie Payments for WooCommerce
affected:
  - mollie_payments_for_woocommerce < 8.2.0
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-11-04T14:07:53.466972Z'
published: '2026-11-04'
updated: '2026-11-04'
sourceUpdated: '2026-11-04T14:18:23.602Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-101166'
references:
  - url: 'https://wpscan.com/vulnerability/67794161-4243-4587-819c-7ee53f920fa2/'
tags:
  - cve.org
epss: 0.00244
epssPercentile: 0.15685
ingestedAt: '2026-11-05T21:36:00.375Z'
---

## Overview

The Mollie Payments for WooCommerce WordPress plugin before 8.2.0 does not verify a product's publication status before creating an order for it through its PayPal express-checkout endpoint, allowing unauthenticated users to order draft or unpublished products.

## Affected

- `mollie_payments_for_woocommerce < 8.2.0`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.