CVE-2026-68500
1 advisory.
Packagist/sylius/mollie-plugin CVE-2026-68500: high 7.5, EPSS 0.68%
Sylius Mollie Plugin vulnerable to payment status forgery via the payment webhook
Action: Upgrade sylius/mollie-plugin to 2.2.8 or later.
composer require sylius/mollie-plugin:2.2.8composer require sylius/mollie-plugin:3.2.4composer require sylius/mollie-plugin:3.3.1Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 2.2.8 | - |
| 3.0.0 | 3.2.4 | - |
| 3.3.0 | 3.3.1 | - |
Fixed versions
| 2.2.8 | 3.2.4 | 3.3.1 |
Sources
- osv: GHSA-rc52-c4hv-w89p
- https://github.com/Sylius/MolliePlugin/security/advisories/GHSA-rc52-c4hv-w89p
- https://nvd.nist.gov/vuln/detail/CVE-2026-68500
- https://github.com/Sylius/MolliePlugin/pull/351
- https://github.com/Sylius/MolliePlugin/pull/352
- https://github.com/Sylius/MolliePlugin/pull/354
- https://github.com/Sylius/MolliePlugin/commit/01316b3ad3cf82e3c5ad160115d0a2cf89174e49
- https://github.com/Sylius/MolliePlugin/commit/153c754486b1bc597b67a90ac07ef71cd7958267
- https://github.com/Sylius/MolliePlugin/commit/d1f7753e92106e8bf3bedcfc61b02ea7b8e1c38a
- https://github.com/Sylius/MolliePlugin
- https://github.com/Sylius/MolliePlugin/releases/tag/v2.2.8
- https://github.com/Sylius/MolliePlugin/releases/tag/v3.2.4
- https://github.com/Sylius/MolliePlugin/releases/tag/v3.3.1
CVE-2026-68500 · published · modified · JSON