CVE-2026-28180: WordPress Mercado Pago payments for WooCommerce plugin <= 8.9.0 - Insecure Direct Object References (IDOR) vulnerability

Published Aug 6, 2026

Updated

Unauthenticated Insecure Direct Object References (IDOR) in Mercado Pago payments for WooCommerce <= 8.9.0 versions.

Affected Software

1 affected component

WooCommerce Mercado Pago payments<=8.9.0

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade WordPress Mercado Pago payments for WooCommerce plugin to a version that resolves this vulnerability.
Fixed in 8.9.1

Aug 6, 2026

CVE Published

via MITRE·02:27 PM

Data Sourced

via MITRE·02:27 PM

RemedyDescriptionSeverityWeakness

CVE-2026-28180 is classified with a medium severity rating of 5.3.

CVE-2026-28180 is an Insecure Direct Object References (IDOR) vulnerability.

To fix CVE-2026-28180, update the Mercado Pago payments for WooCommerce plugin to the latest version beyond 8.9.0.

CVE-2026-28180 affects versions of the Mercado Pago payments for WooCommerce plugin up to and including 8.9.0.

Users of the WooCommerce Mercado Pago payments plugin who have not updated past version 8.9.0 are at risk from CVE-2026-28180.