Mercado Pago

Records4All Threatist records

Exploited (KEV)0None in CISA KEV

CVSS critical0CVSS 9.0–10.0

CVSS high2CVSS 7.0–8.9

Exploited now

Mercado Pago records in CISA KEV

No Mercado Pago vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records

Mercado Pago Payments For Woocommerce 1 record LOW

Records

4 records

TI-2026-53678 CVE-2026-76842 · GHSA-8vxq-h2gr-x277

Mercado Pago Node.js SDK through 3.4.0 Path Injection via Unencoded Identifiers in Payment Clients

MEDIUM 45

The Mercado Pago Node.js SDK interpolates caller-supplied identifiers into API request paths without percent-encoding them, so characters that are structural in a URL survive into the outgoing request.

CVSS 4.0HIGH 8.8 Network No auth No interaction EPSS 0.00487 Published 2026-08-24 No fix listed CWE-22

TI-2022-22159 CVE-2022-45068 · GHSA-94cc-rhf9-48mv

WordPress Mercado Pago payments for WooCommerce Plugin <= 6.3.1 is vulnerable to Cross Site Request Forgery (CSRF)

LOW 38

Cross-Site Request Forgery (CSRF) vulnerability in Mercado Pago Mercado Pago payments for WooCommerce plugin <= 6.3.1.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.00285 Published 2023-03-01 No fix listed CWE-352

TI-2026-02771 CVE-2026-3208 · GHSA-cfhj-895c-686j

Missing authorization in Mercado Pago payments for WooCommerce

LOW 31

The Mercado Pago payments for WooCommerce plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'mp_pix_image' WooCommerce API endpoint in all versions up to, and incl…

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00499 Published 2026-05-06 No fix listed CWE-862

TI-2026-22520 CVE-2026-28180 · GHSA-qc5m-7r97-w8mq

WordPress Mercado Pago payments for WooCommerce plugin <= 8.9.0 - Insecure Direct Object References (IDOR) vulnerability

LOW 30

Unauthenticated Insecure Direct Object References (IDOR) in Mercado Pago payments for WooCommerce <= 8.9.0 versions.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00313 Published 2026-08-06 No fix listed CWE-639

Open these records in search →

Critical	0
High	2
Medium	2
Low	0
No CVSS	0