Mercado Pago Payments For Woocommerce
Monthly
Unauthenticated IDOR in Mercado Pago payments for WooCommerce plugin (≤8.9.0) exposes order or payment objects to remote attackers without any authentication requirement. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms network-accessible exploitation at low complexity with no credentials needed, resulting in limited confidentiality breach (C:L). No public exploit code or CISA KEV listing has been identified at time of analysis, but the zero-barrier entry point makes enumeration of payment and order references realistic for opportunistic actors targeting WooCommerce storefronts.
Unauthenticated attackers can retrieve PIX payment QR code images for arbitrary WooCommerce orders via the unprotected 'mp_pix_image' API endpoint in Mercado Pago payments for WooCommerce plugin versions up to 8.7.11, exposing sensitive merchant data including PIX keys, transaction amounts, merchant identity, and Mercado Pago transaction references. The vulnerability requires no authentication, user interaction, or special configuration, and exploits a missing capability check in the WordPress REST API handler. No public exploit code or active exploitation has been confirmed at the time of analysis.
Cross-Site Request Forgery (CSRF) vulnerability in Mercado Pago Mercado Pago payments for WooCommerce plugin <= 6.3.1. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Unauthenticated IDOR in Mercado Pago payments for WooCommerce plugin (≤8.9.0) exposes order or payment objects to remote attackers without any authentication requirement. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms network-accessible exploitation at low complexity with no credentials needed, resulting in limited confidentiality breach (C:L). No public exploit code or CISA KEV listing has been identified at time of analysis, but the zero-barrier entry point makes enumeration of payment and order references realistic for opportunistic actors targeting WooCommerce storefronts.
Unauthenticated attackers can retrieve PIX payment QR code images for arbitrary WooCommerce orders via the unprotected 'mp_pix_image' API endpoint in Mercado Pago payments for WooCommerce plugin versions up to 8.7.11, exposing sensitive merchant data including PIX keys, transaction amounts, merchant identity, and Mercado Pago transaction references. The vulnerability requires no authentication, user interaction, or special configuration, and exploits a missing capability check in the WordPress REST API handler. No public exploit code or active exploitation has been confirmed at the time of analysis.
Cross-Site Request Forgery (CSRF) vulnerability in Mercado Pago Mercado Pago payments for WooCommerce plugin <= 6.3.1. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.