CVE-2024-3934

The Mercado Pago payments for WooCommerce plugin for WordPress is vulnerable to Path Traversal in versions 7.3.0 to 7.5.1 via the mercadopagoDownloadLog function. This makes it possible for authenticated attackers, with subscriber-level access and above, to download and read the contents of arbitrary files on the server, which can contain sensitive information. The arbitrary file download was patched in 7.5.1, while the missing authorization was corrected in version 7.6.2.

• CWE-22

• https://plugins.trac.wordpress.org/browser/woocommerce-mercadopago/trunk/src/Admin/Settings.php#L663
• https://plugins.trac.wordpress.org/changeset/3098023/woocommerce-mercadopago/trunk/src/IO/Downloader.php?old=3078706&old_path=woocommerce-mercadopago%2Ftrunk%2Fsrc%2FIO%2FDownloader.php
• https://plugins.trac.wordpress.org/changeset/3119214/woocommerce-mercadopago/tags/7.6.2/src/IO/Downloader.php?old=3108278&old_path=woocommerce-mercadopago%2Ftags%2F7.6.1%2Fsrc%2FIO%2FDownloader.php
• https://www.wordfence.com/threat-intel/vulnerabilities/id/1674e81e-6a75-436c-b219-8ec0a484a134?source=cve
• https://plugins.trac.wordpress.org/browser/woocommerce-mercadopago/trunk/src/Admin/Settings.php#L663
• https://plugins.trac.wordpress.org/changeset/3098023/woocommerce-mercadopago/trunk/src/IO/Downloader.php?old=3078706&old_path=woocommerce-mercadopago%2Ftrunk%2Fsrc%2FIO%2FDownloader.php
• https://plugins.trac.wordpress.org/changeset/3119214/woocommerce-mercadopago/tags/7.6.2/src/IO/Downloader.php?old=3108278&old_path=woocommerce-mercadopago%2Ftags%2F7.6.1%2Fsrc%2FIO%2FDownloader.php
• https://www.wordfence.com/threat-intel/vulnerabilities/id/1674e81e-6a75-436c-b219-8ec0a484a134?source=cve

Published

Jul 20, 2024

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-39332Webswing 23.2.2 allows remote attackers to modify client-sid…9.8
• CVE-2024-39334MENDELSON AS4 before 2024 B376 has a client-side vulnerabili…6.5
• CVE-2024-39335Supported versions of Mahara 24.04 before 24.04.1 and 23.04 …9.1
• CVE-2024-39337Click Studios Passwordstate Core before 9.8 build 9858 allow…6.5
• CVE-2024-39338axios 1.7.2 allows SSRF via unexpected behavior where reques…7.5
• CVE-2024-39339A vulnerability has been discovered in all versions of Smart…7.5
• CVE-2024-39340The authentication system of Securepoint UTM mishandles OTP …8.8
• CVE-2024-39341Entrust Instant Financial Issuance (On Premise) Software (fo…5.9
• CVE-2024-39342Entrust Instant Financial Issuance (formerly known as Cardwi…6.6
• CVE-2024-39343An issue was discovered in Samsung Mobile Processor and Wear…7
• CVE-2024-39344An issue was discovered in the Docusign API package 8.142.14…8.1
• CVE-2024-39345AdTran 834-5 HDC17600021F1 (SmartOS 11.1.1.1) devices enable…7.2