Commerce Mollie
Monthly
Unauthenticated payment reuse in the Craft Commerce Mollie plugin (versions 2.1.1 through 4.4.2) allows anyone holding a single valid paid Mollie payment ID from the merchant's account to pair it with an arbitrary Craft Commerce transaction hash, causing that target transaction to be marked paid for its full amount and releasing goods or services without payment. No authentication or user interaction is required; the one concrete prerequisite is obtaining a genuinely paid payment ID belonging to the same merchant account, for example via a low-value legitimate purchase. The plugin is fixed in 4.4.3, and no public exploit has been identified at time of analysis.
Unauthenticated payment reuse in the Craft Commerce Mollie plugin (versions 2.1.1 through 4.4.2) allows anyone holding a single valid paid Mollie payment ID from the merchant's account to pair it with an arbitrary Craft Commerce transaction hash, causing that target transaction to be marked paid for its full amount and releasing goods or services without payment. No authentication or user interaction is required; the one concrete prerequisite is obtaining a genuinely paid payment ID belonging to the same merchant account, for example via a low-value legitimate purchase. The plugin is fixed in 4.4.3, and no public exploit has been identified at time of analysis.