Sylius Mollie Plugin allows a user without authentication to request a sequential order ID through its thank‑you and QR code endpoints. The plugin then returns an order token that can be used with another public endpoint to expose the customer’s first name, last name, and email. The weakness is an IDOR that reveals sensitive personal data without any ownership or session checks. This data leakage is limited to PII and token values, and does not enable arbitrary command execution or system compromise.

The vulnerability affects the Sylius Mollie Plugin. Any installation using a version older than v2.2.8, v3.2.4, or v3.3.1 is susceptible. The plugin is part of Sylius applications that integrate Mollie payment processing.

The CVSS base score of 6.5 indicates moderate severity, while the EPSS score is less than 1%, indicating a low probability of exploitation. The issue is not listed in CISA KEV. An attacker can exploit the flaw simply by sending HTTP GET requests to the public endpoints; no authentication or privileged access is required. A standard web crawler or malicious user can enumerate sequential order IDs to harvest PII, raising privacy compliance risks, but not system compromise.