The MPWizard – Create Mercado Pago Payment Links plugin for WordPress contains a Cross‑Site Request Forgery vulnerability that allows an unauthenticated attacker to trigger global post deletions. The flaw arises from missing or improperly validated nonce checks in the admin table handling code. If an attacker can entice an administrator to open a crafted URL, that admin’s authenticated session can be used to delete any WordPress post that the admin has permission to delete.

The vulnerability affects laudanumsoft’s MPWizard – Create Mercado Pago Payment Links plugin, any WordPress installation running the plugin up to and including version 1.2.1. No CPE string detail is required for the assessment, but administrators should verify that the plugin is not in the affected version range.

The CVSS base score of 4.3 places this vulnerability in the moderate range, and the EPSS score of less than 1% indicates a very low likelihood of exploitation in the wild. As it is not listed in CISA’s KEV catalog, there are no known active exploitation campaigns reported. The attack vector is CSRF; the attacker requires an authenticated administrator’s session and a social‑engineering promise to click a malicious link. While the impact is limited to post deletion, it can disrupt site content and lead to reputational or revenue loss.