high · CVSS v3 7.5

CVE-2026-122062

The Pronamic Pay WordPress plugin (v<11.1.0) and Pronamic Pay doneren met Mollie WordPress plugin (v<1.7.1) expose stored form submissions v

Overview

The Pronamic Pay WordPress plugin (v<11.1.0) and Pronamic Pay doneren met Mollie WordPress plugin (v<1.7.1) expose stored form submissions via the REST API to unauthenticated users. This flaw allows attackers to read visitor-submitted messages without authentication. The vulnerability can lead to privacy violations for site users.

Description

The Pronamic Pay WordPress plugin before 11.1.0, Pronamic Pay doneren met Mollie WordPress plugin before 1.7.1 do not restrict access to stored form submissions through the REST API, allowing unauthenticated users to read the messages that visitors submitted through the bundled forms.

Impact

Confidentiality of form submissions is compromised, exposing personal or payment-related information. Site administrators and owners are affected as they lose control over sensitive data. Users who submitted data may have their information disclosed to third parties. The breach does not alter data integrity or availability.

Remediation

Upgrade Pronamic Pay WordPress plugin to version 11.1.0 or later and upgrade Pronamic Pay doneren met Mollie WordPress plugin to version 1.7.1 or later. If an upgrade is not immediately possible, restrict REST API access to the affected endpoints using .htaccess rules or a security plugin, or disable the REST API for those endpoints. Verify that the REST API no longer returns form submissions by testing with an unauthenticated request.

Risk context

The vulnerability is rated high with a CVSS v3 score of 7.5. No EPSS data is available, but the lack of authentication for sensitive data warrants prompt attention. Defenders should treat this as a moderate to high priority issue.

Affected products

  • Pronamic Pay WordPress plugin
  • Pronamic Pay doneren met Mollie WordPress plugin

Scores

Severity
high
CVSS v2
5
CVSS v3
7.5
CVSS v4
—
EPSS
—

WordPress plugin REST API unauthenticated confidentiality data exposure high severity

← All CVEs

Related CVEs

high

CVE-2026-123558

Zebra zebrad before 7.0.0 is vulnerable to a denial‑of‑service that can be triggered by a malicious peer during checkpoint synchronization. By cancelling the verifier rewind after a failed commit, an attacker can cause the node to reject legitimate blocks until it is restarted. This disrupts network availability and can stall consensus.

View analysis

high

CVE-2026-123559

Zebra before 7.0.0 contains an inefficient algorithmic complexity vulnerability that allows unauthenticated peers to exhaust verification threads by submitting transactions with many transparent inputs. Attackers can relay invalid transactions with tens of thousands of inputs, forcing quadratic ZIP-244 or ZIP-243 digest recomputation that stalls Rayon-backed block verification for minutes.

View analysis

high

CVE-2026-123560

Zebra before 7.0.0 contains an incomplete cleanup vulnerability that allows unauthenticated peers to stall initial sync by serving a forged checkpoint block body. Attackers can supply a body with forged authorizing data near the final checkpoint, leaving rejected hashes in the sent-hash set so the node stops requesting blocks until restart.

View analysis

high

CVE-2026-123562

devalue (sveltejs/devalue) 5.8.0 before 5.9.3 contains an unhandled promise rejection in stringifyAsync: when serializing multiple promises, a later promise rejecting before an earlier one settles leaves an internal rejection unhandled, even if the caller catches the returned promise. An attacker able to influence the timing or failure of serialized asynchronous values can terminate the Node.js process.

View analysis