CVE-2026-101166

{
  "etk_id": "ETK-2026-3465",
  "cve_id": "CVE-2026-101166",
  "display_id": "CVE-2026-101166",
  "ghsa_id": "GHSA-gw66-w4f9-383p",
  "euvd_id": "EUVD-2026-116759",
  "status": "published",
  "anchor_state": "anchored",
  "title": "Publication-status validation flaw in Mollie Payments for WooCommerce",
  "summary": "Mollie Payments for WooCommerce versions earlier than 8.2.0 may allow orders to be created for products that are not publicly published. An unauthenticated attacker can abuse the PayPal Express Checkout order flow when draft or unpublished products are present.",
  "mitigation": "Upgrade Mollie Payments for WooCommerce to version 8.2.0 or later. Review draft and unpublished product listings while applying the update.",
  "vendor": null,
  "product": "Mollie Payments for WooCommerce",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= 0, < 8.2.0"
      ],
      "ecosystem": null,
      "fixed_versions": [
        "8.2.0"
      ],
      "package_name": "Mollie Payments for WooCommerce",
      "purl": null
    }
  ],
  "cwes": null,
  "cvss_score": null,
  "cvss_src": null,
  "cvss_vector": null,
  "epss_score": null,
  "epss_percentile": null,
  "epss_asof": null,
  "automation": "contextual",
  "check": false,
  "check_confidence_basis": null,
  "exploit": false,
  "pipeline_minutes": 37.6872679,
  "t0_at": "2026-11-04T06:00:23.667000+00:00",
  "signals": {
    "trigger_signal": {
      "at": "2026-11-04T06:00:23.667000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-11-04T06:00:23.667000+00:00",
      "url": "https://github.com/advisories/GHSA-gw66-w4f9-383p"
    }
  }
}