{"api_version":"1","generated_at":"2026-11-08T15:49:14+00:00","cve":"CVE-2026-122062","urls":{"html":"https://cve.report/CVE-2026-122062","api":"https://cve.report/api/cve/CVE-2026-122062.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2026-122062","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2026-122062"},"summary":{"title":"Pronamic Pay & Pronamic Pay doneren met Mollie - Unauthenticated Form Submission Disclosure via REST API","description":"The Pronamic Pay WordPress plugin before 11.1.0, Pronamic Pay doneren met Mollie WordPress plugin before 1.7.1 do not restrict access to stored form submissions through the REST API, allowing unauthenticated users to read the messages that visitors submitted through the bundled forms.","state":"PUBLISHED","assigner":"WPScan","published_at":"2026-11-08 06:17:05","updated_at":"2026-11-08 06:17:05"},"problem_types":["CWE-200 Information Exposure"],"metrics":[],"references":[{"url":"https://wpscan.com/vulnerability/02674a18-1985-4a35-a59e-906ce4a61972/","name":"https://wpscan.com/vulnerability/02674a18-1985-4a35-a59e-906ce4a61972/","refsource":"contact@wpscan.com","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-122062","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-122062","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"Unknown","product":"Pronamic Pay","version":"affected 11.1.0 semver","platforms":[]},{"source":"CNA","vendor":"Unknown","product":"Pronamic Pay doneren met Mollie","version":"affected 1.7.1 semver","platforms":[]}],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[{"source":"CNA","value":"Aaron - WellKnown","lang":"en"},{"source":"CNA","value":"WPScan","lang":"en"}],"nvd_cpes":[],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"cna":{"affected":[{"defaultStatus":"unaffected","product":"Pronamic Pay","vendor":"Unknown","versions":[{"lessThan":"11.1.0","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"Pronamic Pay doneren met Mollie","vendor":"Unknown","versions":[{"lessThan":"1.7.1","status":"affected","version":"0","versionType":"semver"}]}],"credits":[{"lang":"en","type":"finder","value":"Aaron - WellKnown"},{"lang":"en","type":"coordinator","value":"WPScan"}],"descriptions":[{"lang":"en","value":"The Pronamic Pay WordPress plugin before 11.1.0, Pronamic Pay doneren met Mollie WordPress plugin before 1.7.1 do not restrict access to stored form submissions through the REST API, allowing unauthenticated users to read the messages that visitors submitted through the bundled forms."}],"problemTypes":[{"descriptions":[{"description":"CWE-200 Information Exposure","lang":"en","type":"CWE"}]}],"providerMetadata":{"dateUpdated":"2026-11-08T06:00:27.481Z","orgId":"1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81","shortName":"WPScan"},"references":[{"tags":["exploit","vdb-entry","technical-description"],"url":"https://wpscan.com/vulnerability/02674a18-1985-4a35-a59e-906ce4a61972/"}],"source":{"discovery":"EXTERNAL"},"title":"Pronamic Pay & Pronamic Pay doneren met Mollie - Unauthenticated Form Submission Disclosure via REST API","x_generator":{"engine":"WPScan CVE Generator"}}},"cveMetadata":{"assignerOrgId":"1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81","assignerShortName":"WPScan","cveId":"CVE-2026-122062","datePublished":"2026-11-08T06:00:27.481Z","dateReserved":"2026-11-04T16:45:18.888Z","dateUpdated":"2026-11-08T06:00:27.481Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.2"},"nvd":{"publishedDate":"2026-11-08 06:17:05","lastModifiedDate":"2026-11-08 06:17:05","problem_types":["CWE-200 Information Exposure"],"metrics":[],"configurations":[]},"legacy_mitre":{"record":{"CveYear":"2026","CveId":"122062","Ordinal":"1","Title":"Pronamic Pay & Pronamic Pay doneren met Mollie - Unauthenticated","CVE":"CVE-2026-122062","Year":"2026"},"notes":[{"CveYear":"2026","CveId":"122062","Ordinal":"1","NoteData":"The Pronamic Pay WordPress plugin before 11.1.0, Pronamic Pay doneren met Mollie WordPress plugin before 1.7.1 do not restrict access to stored form submissions through the REST API, allowing unauthenticated users to read the messages that visitors submitted through the bundled forms.","Type":"Description","Title":"Pronamic Pay & Pronamic Pay doneren met Mollie - Unauthenticated"}]}}}