Mollieplugin
Monthly
Payment-authorization bypass in the Sylius Mollie Plugin (versions before 2.2.8, 3.2.4, and 3.3.1) lets an unauthenticated attacker mark any victim order as paid without transferring funds. The plugin's POST /{_locale}/update-payment webhook trusts attacker-supplied id and orderId parameters and never verifies that the referenced Mollie payment belongs to the referenced Sylius order, so possession of any single valid paid Mollie payment ID is enough to forge a paid status on arbitrary orders. There is no public exploit identified at time of analysis and the flaw is not in CISA KEV, but the root cause is straightforward and the impact is a direct financial-fraud primitive against the shop.
Sequential integer order ID enumeration in Sylius MolliePlugin exposes customer PII across all orders without authentication. The thank-you and QR-code endpoints accept a raw integer orderId query parameter with no ownership or session validation, allowing unauthenticated remote attackers to iterate through all orders, extract non-guessable tokenValue identifiers, and subsequently query the register-after-checkout endpoint to retrieve customer first names, last names, and email addresses. No active exploitation confirmed (not in CISA KEV) and no public proof-of-concept exploit has been identified, but the attack requires zero authentication and minimal skill, making it a realistic threat to any publicly-facing Sylius shop using the Mollie payment gateway.
Payment-authorization bypass in the Sylius Mollie Plugin (versions before 2.2.8, 3.2.4, and 3.3.1) lets an unauthenticated attacker mark any victim order as paid without transferring funds. The plugin's POST /{_locale}/update-payment webhook trusts attacker-supplied id and orderId parameters and never verifies that the referenced Mollie payment belongs to the referenced Sylius order, so possession of any single valid paid Mollie payment ID is enough to forge a paid status on arbitrary orders. There is no public exploit identified at time of analysis and the flaw is not in CISA KEV, but the root cause is straightforward and the impact is a direct financial-fraud primitive against the shop.
Sequential integer order ID enumeration in Sylius MolliePlugin exposes customer PII across all orders without authentication. The thank-you and QR-code endpoints accept a raw integer orderId query parameter with no ownership or session validation, allowing unauthenticated remote attackers to iterate through all orders, extract non-guessable tokenValue identifiers, and subsequently query the register-after-checkout endpoint to retrieve customer first names, last names, and email addresses. No active exploitation confirmed (not in CISA KEV) and no public proof-of-concept exploit has been identified, but the attack requires zero authentication and minimal skill, making it a realistic threat to any publicly-facing Sylius shop using the Mollie payment gateway.