CVE-2023-6090 is a critical (CVSS 9.1) unrestricted file upload flaw in Mollie Payments for WooCommerce, versions through 7.3.11. Patchstack says it is fixed in 7.3.12 and that the required privilege is shop manager. Update to 7.3.12 or later and look for stray files in your uploads.
What's affected
- Plugin: Mollie Payments for WooCommerce, by Mollie.
- Affected: versions through 7.3.11.
- Fixed: 7.3.12, per Patchstack.
- Severity: 9.1 Critical in the NVD record and in Patchstack. Patchstack sets its own priority label to Medium, because an account is needed.
- Privilege needed: shop manager, per Patchstack. The record does not state a privilege level.
How to check if you're exposed
In the WordPress admin, open Plugins and read the version shown under Mollie Payments for WooCommerce. With shell access and WP-CLI, this lists every installed plugin with its version, status and whether an update is waiting:
wp plugin list --fields=name,title,version,status,update
Find the row for Mollie Payments for WooCommerce and compare its version with the fixed version above. On a multisite network, run the same command on each site, because a plugin can be active on some sites and not others. The folder is mollie-payments-for-woocommerce.
A version of 7.3.11 or lower is affected. Also list who holds the shop manager role, since the flaw needs that level of access:
wp user list --role=shop_manager --fields=ID,user_login,user_email
What to do now
- Update Mollie Payments for WooCommerce to 7.3.12 or later.
- List shop manager accounts, and remove or downgrade ones that are not needed.
- Search the uploads folder for script files that do not belong, such as files ending in .php.
- Disable script execution in the uploads directory at the web server level.
- Rotate passwords for shop managers and administrators if you find anything unexpected.
Why it matters
The plugin accepts an uploaded file without checking that its type is safe. The record lists CWE-434, unrestricted upload of a file with a dangerous type. Patchstack says attackers can upload malicious files that can be used to take the server over. A script placed in a web reachable folder and executed by the server turns a store account into code execution.
The 9.1 score reflects the high impact. The access requirement is an important limit, and it explains why Patchstack calls the priority Medium. Store sites tend to have more privileged users than a blog: staff, agencies and contractors. Each one is an account that could be phished or reused. The record does not list this CVE as known exploited. Patching, trimming roles and blocking execution in uploads give layered protection.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Why does Patchstack say Medium when the score is 9.1?
Patchstack weighs the need for a shop manager account. The CVSS base score stays at 9.1, and the label reflects its own view of how likely abuse is.
Sources
Last reviewed: 19 October 2026.
