Vulnerabilities

TI-2026-53678 CVE-2026-76842 · GHSA-8vxq-h2gr-x277

Mercado Pago Node.js SDK through 3.4.0 Path Injection via Unencoded Identifiers in Payment Clients

MEDIUM 45

The Mercado Pago Node.js SDK interpolates caller-supplied identifiers into API request paths without percent-encoding them, so characters that are structural in a URL survive into the outgoing request.

CVSS 4.0HIGH 8.8 Network No auth No interaction EPSS 0.00487 Published 2026-08-24 No fix listed CWE-22

TI-2026-22520 CVE-2026-28180 · GHSA-qc5m-7r97-w8mq

WordPress Mercado Pago payments for WooCommerce plugin <= 8.9.0 - Insecure Direct Object References (IDOR) vulnerability

LOW 30

Unauthenticated Insecure Direct Object References (IDOR) in Mercado Pago payments for WooCommerce <= 8.9.0 versions.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00313 Published 2026-08-06 No fix listed CWE-639

TI-2026-02771 CVE-2026-3208 · GHSA-cfhj-895c-686j

Missing authorization in Mercado Pago payments for WooCommerce

LOW 31

The Mercado Pago payments for WooCommerce plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'mp_pix_image' WooCommerce API endpoint in all versions up to, and incl…

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00499 Published 2026-05-06 No fix listed CWE-862

TI-2022-22159 CVE-2022-45068 · GHSA-94cc-rhf9-48mv

WordPress Mercado Pago payments for WooCommerce Plugin <= 6.3.1 is vulnerable to Cross Site Request Forgery (CSRF)

LOW 38

Cross-Site Request Forgery (CSRF) vulnerability in Mercado Pago Mercado Pago payments for WooCommerce plugin <= 6.3.1.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.00285 Published 2023-03-01 No fix listed CWE-352

Vulnerabilities

Filters

Mercado Pago Node.js SDK through 3.4.0 Path Injection via Unencoded Identifiers in Payment Clients

WordPress Mercado Pago payments for WooCommerce plugin <= 8.9.0 - Insecure Direct Object References (IDOR) vulnerability

Missing authorization in Mercado Pago payments for WooCommerce

WordPress Mercado Pago payments for WooCommerce Plugin <= 6.3.1 is vulnerable to Cross Site Request Forgery (CSRF)