Sylius Mollie Plugin’s payment webhook endpoint accepts POST requests that include an `id` and `orderId`. Before version 2.2.8 of the 2.x series and before 3.2.4 and 3.3.1 of the 3.x series, the plugin fails to confirm that the supplied Mollie payment identifier actually belongs to the referenced Sylius order. An attacker who knows any Mollie payment that has already completed can craft a request that marks an unrelated order as paid, allowing the merchant to assume the order is fulfilled without receiving any funds. This bypasses critical authorization checks and constitutes a payment status forgery flaw (CWE‑639).

Customers running Sylius Mollie Plugin versions older than 2.2.8 in the 2.x line, older than 3.2.4 in the 3.2.x line, or older than 3.3.1 in the 3.3.x line are affected. The vulnerability exists in the POST /{locale}/update-payment endpoint. Based on the description, it is inferred that the plugin applies to all Symfony applications that integrate this plugin. Vendor release pages indicate that these affected releases correspond to the 2.2.x, 3.2.x, and 3.3.x series defined in the GitHub release tags.

The CVSS score of 7.5 indicates a high‑severity flaw with high impact if exploited. The EPSS score is listed as <1 %, reflecting a low exploitation probability at this time, and the vulnerability is not on CISA’s KEV list. Nevertheless, the flaw is remotely exploitable via the public webhook endpoint with no authentication required. An attacker can freely bind any valid Mollie payment to a victim order, creating fraudulent financial records and potentially causing loss of revenue. The lack of a dedicated authentication mechanism on the endpoint makes deployment of this vulnerability straightforward in a production environment, warranting prompt remediation.