Known vulnerabilities in Mercado Pago payments for WooCommerce

Offer to your clients the best experience in e-Commerce by using Mercado Pago as your payment method.

5Reported vulnerabilities

6.5Highest CVSS score

8.9.2Latest version

100,000+Active installs

What to do now

Update Mercado Pago payments for WooCommerce to 8.9.1 or later. 5 of these have a fixed version available. Updating resolves them.

Plugin last updated: August 17, 2026 / Tested up to WordPress: 7.0.4 / View on wordpress.org

Reported vulnerabilities

Ordered by how urgently they need attention — whether a vulnerability is actually being exploited, and how likely exploitation is, rather than CVSS severity alone.

CVE	Severity	Exploit probability next 30 days	Affected versions	Fixed in	Published
CVE-2024-3934	Medium 6.5	0.7%	7.3.0 to 7.6.1 (inclusive)	`7.6.2`	July 20, 2024
CVE-2026-28180	Medium 5.3	0.2%	8.9.0 and earlier	`8.9.1`	August 5, 2026
CVE-2026-3208	Medium 5.3	0.5%	0 to 8.7.11 (inclusive)	`8.7.12`	May 6, 2026
CVE-2022-45068	Medium 4.3	0.3%	6.3.1 and earlier	`6.4.0`	February 6, 2023
WF-b20b4eba-54df-4e08-ba4c-96f8bb463125	Medium 4.3	—	6.6.0 and earlier	`6.7.0`	January 23, 2023

Sources: vulnerability records from NVD, exploitation from CISA KEV, exploit probability from EPSS. Affected versions come from CPE ranges or from the reporting CNA.