Mercadopago
Monthly
Path traversal in the Mercado Pago Node.js SDK allows attackers who can influence payment, refund, or disbursement identifiers handled by merchant applications to redirect outbound API calls to unintended Mercado Pago endpoints, carrying the merchant's own access token. The affected clients - payment (get, capture, cancel), paymentRefund (create, total, list, get), advancedPayment (get, capture, cancel, update, updateReleaseDate), and disbursementRefund (create, createAll, listAll) - construct API paths via unencoded template literals, allowing dot-dot sequences and question marks to traverse to alternate endpoints or append attacker-chosen query parameters. No public exploit has been identified at time of analysis, and exploitation is conditional on merchant applications forwarding unvalidated, user-supplied identifiers directly to the SDK.
Unauthenticated attackers can retrieve PIX payment QR code images for arbitrary WooCommerce orders via the unprotected 'mp_pix_image' API endpoint in Mercado Pago payments for WooCommerce plugin versions up to 8.7.11, exposing sensitive merchant data including PIX keys, transaction amounts, merchant identity, and Mercado Pago transaction references. The vulnerability requires no authentication, user interaction, or special configuration, and exploits a missing capability check in the WordPress REST API handler. No public exploit code or active exploitation has been confirmed at the time of analysis.
Cross-Site Request Forgery (CSRF) vulnerability in Mercado Pago Mercado Pago payments for WooCommerce plugin <= 6.3.1. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Path traversal in the Mercado Pago Node.js SDK allows attackers who can influence payment, refund, or disbursement identifiers handled by merchant applications to redirect outbound API calls to unintended Mercado Pago endpoints, carrying the merchant's own access token. The affected clients - payment (get, capture, cancel), paymentRefund (create, total, list, get), advancedPayment (get, capture, cancel, update, updateReleaseDate), and disbursementRefund (create, createAll, listAll) - construct API paths via unencoded template literals, allowing dot-dot sequences and question marks to traverse to alternate endpoints or append attacker-chosen query parameters. No public exploit has been identified at time of analysis, and exploitation is conditional on merchant applications forwarding unvalidated, user-supplied identifiers directly to the SDK.
Unauthenticated attackers can retrieve PIX payment QR code images for arbitrary WooCommerce orders via the unprotected 'mp_pix_image' API endpoint in Mercado Pago payments for WooCommerce plugin versions up to 8.7.11, exposing sensitive merchant data including PIX keys, transaction amounts, merchant identity, and Mercado Pago transaction references. The vulnerability requires no authentication, user interaction, or special configuration, and exploits a missing capability check in the WordPress REST API handler. No public exploit code or active exploitation has been confirmed at the time of analysis.
Cross-Site Request Forgery (CSRF) vulnerability in Mercado Pago Mercado Pago payments for WooCommerce plugin <= 6.3.1. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.