CVE-2026-122062 PUBLISHED

Pronamic Pay & Pronamic Pay doneren met Mollie - Unauthenticated Form Submission Disclosure via REST API

Assigner: WPScan
Reserved: 04.11.2026 Published: 08.11.2026 Updated: 08.11.2026

The Pronamic Pay WordPress plugin before 11.1.0, Pronamic Pay doneren met Mollie WordPress plugin before 1.7.1 do not restrict access to stored form submissions through the REST API, allowing unauthenticated users to read the messages that visitors submitted through the bundled forms.

Product Status

Vendor Unknown
Product Pronamic Pay
Versions Default: unaffected
  • affected from 0 to 11.1.0 (excl.)
Vendor Unknown
Product Pronamic Pay doneren met Mollie
Versions Default: unaffected
  • affected from 0 to 1.7.1 (excl.)

Credits

  • Aaron - WellKnown finder
  • WPScan coordinator

References

Problem Types

  • CWE-200 Information Exposure CWE