Sylius Mollie Plugin provides Mollie payment integration for Sylius applications. Prior to 2.2.8, 3.2.4, and 3.3.1, Sylius Mollie Plugin's POST /{_locale}/updat…

A critical vulnerability exists in the Sylius Mollie Plugin prior to versions 2.2.8, 3.2.4, and 3.3.1. The POST /{_locale}/update-payment webhook endpoint accepts attacker-controlled 'id' and 'orderId' parameters without verifying that the Mollie payment belongs to the referenced Sylius order. An unauthenticated attacker with any valid paid Mollie payment ID can mark a victim's order as paid without actually transferring funds. This is essentially a payment bypass vulnerability allowing fraudulent order completion. The flaw stems from insufficient validation of the relationship between payment IDs and order IDs in the webhook handler. Fixes have been released in versions 2.2.8, 3.2.4, and 3.3.1 of the plugin. Three separate commits and pull requests were issued to address the vulnerability across the affected version branches.