CVE-2026-28180

MediumCVSS 5.3

Published: 06/08/2026(UTC)Updated: 23/10/2026(UTC)Translated: 06/08/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.31%

23th percentile - higher than 23% of all known CVEs

Summary

Insecure Direct Object References (IDOR) vulnerability in Mercado Pago payments for WooCommerce versions up to 8.9.0 allows an unauthenticated attacker to access objects without authorization.

Risk Assessment

An attacker can access payment data or other sensitive information, potentially leading to privacy and financial security breaches.

Recommendation

Update the Mercado Pago payments for WooCommerce plugin to the latest version that includes the security fix.

Other vulnerabilities in Mercado Pago payments for WooCommerce

CVE-2026-3208Medium
The Mercado Pago payments for WooCommerce plugin for WordPress (up to version 8.7.11) lacks a capability check on the 'mp_pix_image' API endpoint. Unauthenticated attackers can retrieve PIX QR codes for arbitrary orders, exposing sensitive merchant information including PIX keys (which may contain CPF/CNPJ), transaction amounts, merchant name and city, and transaction references.

Original NVD description (English source)

Unauthenticated Insecure Direct Object References (IDOR) in Mercado Pago payments for WooCommerce <= 8.9.0 versions.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS