CVE-2026-115937 Unauthenticated payment reuse allows unpaid orders to be marked as paid
- Exploited in the wild
- Not known
- Fix
- None listed
What is CVE-2026-115937?
CVE-2026-115937 is a high-severity vulnerability in craftcms commerce-mollie, published on 23 Oct 2026.
Official description
The Mollie webhook endpoint accepts two independent, attacker-controlled parameters and never verifies that they belong together:
* commerceTransactionHash — selects which Craft Commerce transaction is completed * id — selects which Mollie payment is queried for its status
An unauthenticated attacker holding any paid Mollie payment ID from the merchant’s account can pair it with any transaction hash.
Commerce queries Mollie, sees status: paid, and marks the target transaction successful for that transaction’s full amount, regardless of how much was actually paid.
Weakness: CWE-345
Which versions are affected by CVE-2026-115937?
How do I fix CVE-2026-115937?
No fix has been published for CVE-2026-115937 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-115937 being exploited?
There is no known exploitation of CVE-2026-115937 in the wild and no public exploit code.
Sources
Also known as GHSA-3qcx-mjf6-48vj, GHSA-8pqg-7g86-mxqf.