The Pronamic Pay and Pronamic Pay doneren met Mollie WordPress plugins allow unauthenticated users to retrieve form submissions through a publicly accessible REST API. This lack of authentication exposes confidential visitor messages, potentially containing personal or sensitive information, to anyone who can access the API. The weakness is an improper access control that leads to information disclosure.

WordPress sites running the Pronamic Pay plugin prior to version 11.1.0 or the Pronamic Pay doneren met Mollie plugin prior to version 1.7.1 are affected. Users should verify their installed versions and determine whether the vulnerable REST endpoints are exposed.

The exploit is straightforward: any unauthenticated user can issue a GET request to the exposed REST endpoint and retrieve stored forms. No user interaction or elevated privileges are required. While no EPSS score is currently available and the vulnerability has not been listed in CISA's KEV catalog, the lack of protection poses a real risk of data leakage, especially for sites handling sensitive donor information.