What is the CVSS score of CVE-2026-28180?

CVE-2026-28180 has a CVSS 3.1 base score of 5.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.2%.

Mercado Pago WooCommerce CVE-2026-28180

Q: Which versions of Mercado Pago WooCommerce are affected by CVE-2026-28180?

Unauthenticated IDOR in Mercado Pago payments for WooCommerce plugin (≤8.9.0) exposes order or payment objects to remote attackers without any authentication requirement.

EUVD-2026-53952 MEDIUM

Authorization Bypass Through User-Controlled Key (CWE-639)

2026-08-06 Patchstack

GHSA-qc5m-7r97-w8mq

WordPress Authentication Bypass Wordpress Plugin Mercado Pago Payments For Woocommerce

5.3

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

5.3 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

vuln.today AI

5.3 MEDIUM

Network-accessible, zero-auth IDOR with read-only limited data exposure; no integrity or availability impact warranted by description.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Aug 06, 2026 - 16:00 vuln.today

CVE Published

Aug 06, 2026 - 14:27 cve.org

MEDIUM 5.3

DescriptionCVE.org

Unauthenticated Insecure Direct Object References (IDOR) in Mercado Pago payments for WooCommerce <= 8.9.0 versions.

AnalysisAI

Unauthenticated IDOR in Mercado Pago payments for WooCommerce plugin (≤8.9.0) exposes order or payment objects to remote attackers without any authentication requirement. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms network-accessible exploitation at low complexity with no credentials needed, resulting in limited confidentiality breach (C:L). No public exploit code or CISA KEV listing has been identified at time of analysis, but the zero-barrier entry point makes enumeration of payment and order references realistic for opportunistic actors targeting WooCommerce storefronts.

Technical ContextAI

The vulnerability is classified under CWE-639 (Authorization Through User-Controlled Key), a sub-class of broken access control. In this pattern, the plugin accepts a user-supplied identifier - such as an order ID, payment reference, or transaction token - and uses it directly to retrieve a backend object without verifying that the requesting party is authorized to access that specific record. The affected component is the Mercado Pago payments for WooCommerce WordPress plugin, identified by CPE cpe:2.3:a:mercado_pago:mercado_pago_payments_for_woocommerce:*:*:*:*:*:*:*:*, which integrates the Mercado Pago payment gateway (dominant in Latin American e-commerce markets) into WooCommerce storefronts. Payment callback endpoints, order status APIs, or receipt retrieval functions are common surfaces for this pattern in payment plugin integrations. The 'Authentication Bypass' tag from Patchstack further suggests that the IDOR may circumvent intended session or ownership checks.

RemediationAI

Update the Mercado Pago payments for WooCommerce plugin to a version above 8.9.0 via the WordPress plugin dashboard or by downloading directly from the WordPress plugin repository. The exact fixed version number is not independently confirmed in the available input data - consult the Patchstack advisory at https://patchstack.com/database/wordpress/plugin/woocommerce-mercadopago/vulnerability/wordpress-mercado-pago-payments-for-woocommerce-plugin-8-9-0-insecure-direct-object-references-idor-vulnerability?_s_id=cve for the confirmed patched release. As a compensating control if immediate patching is not possible, restrict access to payment callback and order-status endpoints via WAF rules that enforce session-based ownership validation on object identifier parameters; this may interfere with legitimate payment gateway callbacks and should be tested carefully. Additionally, enabling a WordPress security plugin (e.g., Wordfence, Patchstack Shield) with virtual patching capabilities can block exploitation attempts at the firewall layer without modifying the plugin itself.