{"affected":[{"defaultStatus":"unaffected","product":"Mollie Payments for WooCommerce","source":"CNA: WPScan","vendor":"Unknown","versions":[{"lessThan":"8.2.0","status":"affected","version":"0","versionType":"semver"}]}],"cveId":"CVE-2026-101165","cwes":["CWE-862"],"description":"The Mollie Payments for WooCommerce WordPress plugin before 8.2.0 does not verify an order's payment state or the requested payment gateway before removing a configured payment-surcharge fee, allowing unauthenticated users to reduce an order's total before completing payment.","epss":null,"exploits":[{"kind":"exploit","source":"CNA: WPScan","url":"https://wpscan.com/vulnerability/035680b1-abc7-41a7-90e1-e0d053fccf30/"}],"kev":null,"metrics":[],"modifiedAt":1793772023493,"publishedAt":1793772023493,"references":[{"source":"CNA: WPScan","tags":["exploit","vdb-entry","technical-description"],"url":"https://wpscan.com/vulnerability/035680b1-abc7-41a7-90e1-e0d053fccf30/"}],"remediation":[],"revision":"e73702a861993b3118a49d962e9bb92934abf677b32d900bb8b3066e1bb4ac9a","sources":[{"modifiedAt":1793772023493,"name":"CNA: WPScan","retrievedAt":1793776104504,"url":"https://www.cve.org/CVERecord?id=CVE-2026-101165"}],"ssvc":null,"status":"published","title":"Mollie Payments for WooCommerce < 8.2.0 - Unauthenticated Payment Surcharge Bypass via update_surcharge_order_pay","updatedAt":1793776104504}