CVE-2026-3208
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk40th percentile - higher than 40% of all known CVEs
Summary
The Mercado Pago payments for WooCommerce plugin for WordPress (up to version 8.7.11) lacks a capability check on the 'mp_pix_image' API endpoint. Unauthenticated attackers can retrieve PIX QR codes for arbitrary orders, exposing sensitive merchant information including PIX keys (which may contain CPF/CNPJ), transaction amounts, merchant name and city, and transaction references.
Risk Assessment
Risk of leakage of sensitive merchant and customer data, potentially compromising privacy and enabling fraud.
Recommendation
Update the Mercado Pago payments for WooCommerce plugin to the latest version that includes the capability check fix.
Original NVD description (English source)
The Mercado Pago payments for WooCommerce plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'mp_pix_image' WooCommerce API endpoint in all versions up to, and including, 8.7.11. This makes it possible for unauthenticated attackers to retrieve PIX payment QR code images for arbitrary orders. PIX QR codes contain sensitive merchant information including PIX keys (which may be CPF/CNPJ personal identifiers), transaction amounts, merchant name and city, and MercadoPago transaction references.