{"affected":[{"defaultStatus":"unaffected","product":"Mollie Payments for WooCommerce","source":"CNA: WPScan","vendor":"Unknown","versions":[{"lessThan":"8.2.0","status":"affected","version":"0","versionType":"semver"}]}],"cveId":"CVE-2026-101166","cwes":["CWE-862"],"description":"The Mollie Payments for WooCommerce WordPress plugin before 8.2.0 does not verify a product's publication status before creating an order for it through its PayPal express-checkout endpoint, allowing unauthenticated users to order draft or unpublished products.","epss":null,"exploits":[{"kind":"exploit","source":"CNA: WPScan","url":"https://wpscan.com/vulnerability/67794161-4243-4587-819c-7ee53f920fa2/"}],"kev":null,"metrics":[],"modifiedAt":1793772023667,"publishedAt":1793772023667,"references":[{"source":"CNA: WPScan","tags":["exploit","vdb-entry","technical-description"],"url":"https://wpscan.com/vulnerability/67794161-4243-4587-819c-7ee53f920fa2/"}],"remediation":[],"revision":"79ac840de5734b2e430aa8cb1b69976699d921d8baf02256c0812529d14b15d1","sources":[{"modifiedAt":1793772023667,"name":"CNA: WPScan","retrievedAt":1793776108719,"url":"https://www.cve.org/CVERecord?id=CVE-2026-101166"}],"ssvc":null,"status":"published","title":"Mollie Payments for WooCommerce < 8.2.0 - Unauthenticated Unpublished Product Purchase via mollie_paypal_create_order","updatedAt":1793776108719}