The Mollie webhook endpoint of the Craft CMS Commerce Mollie plugin accepts two independent parameters, commerceTransactionHash and id, and fails to verify that they belong to the same payment transaction. An unauthenticated attacker who knows a valid paid Mollie payment ID can pair that ID with any target transaction hash. The plugin queries Mollie, receives a status: paid, and then marks the target Craft Commerce transaction as fully paid regardless of the actual amount paid. This allows the attacker to trigger the completion of an unpaid order, potentially leading to unauthorized goods delivery or service access and financial loss to the merchant.

Craft CMS Commerce Mollie is affected. No specific version data is provided in the CNA record; the latest release available at the time of the advisory is 4.4.3.

The CVSS score of 8.7 indicates high severity. The EPSS score is not available, but the webhook endpoint is exposed without authentication and accepts attacker-controlled input, giving an attacker a clear exploitation path. The vulnerability is not listed in the CISA KEV catalog, but the lack of parameter validation and authentication makes it a serious risk for merchants using this plugin.