Mollie Payments for WooCommerce Fee Bypass Vulnerability

Executive Summary

This vulnerability affects the Mollie Payments for WooCommerce plugin versions before 8.2.0. It allows unauthenticated users to bypass payment surcharges by exploiting a flaw in the update_surcharge_order_pay function. The plugin fails to verify the payment state or the requested payment gateway before removing a configured payment-surcharge fee, letting users reduce an order's total before completing payment.

Useful 0 Not Useful 0

Detection Guidance

Check if your Mollie Payments for WooCommerce plugin version is below 8.2.0. Inspect the update_surcharge_order_pay function in the plugin's code for lack of payment state or gateway verification. Monitor order totals for unauthorized reductions before payment completion.

Useful 0 Not Useful 0

Impact Analysis

Unauthenticated users could exploit this to reduce their order total by removing surcharge fees before completing payment. This could lead to financial losses for merchants using the affected plugin versions prior to 8.2.0.

Useful 0 Not Useful 0

Mitigation Strategies

Update the Mollie Payments for WooCommerce plugin to version 8.2.0 or later immediately. Review recent orders for suspicious surcharge reductions. Implement additional payment verification checks if possible.

Useful 0 Not Useful 0