CVE-2026-3208

The Mercado Pago payments for WooCommerce plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'mp_pix_image' WooCommerce API endpoint in all versions up to, and including, 8.7.11. This makes it possible for unauthenticated attackers to retrieve PIX payment QR code images for arbitrary orders. PIX QR codes contain sensitive merchant information including PIX keys (which may be CPF/CNPJ personal identifiers), transaction amounts, merchant name and city, and MercadoPago transaction references.

CVSS v3 5.3 MEDIUM

5.3^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 3.9 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://plugins.trac.wordpress.org/browser/woocommerce-mercadopago/tags/8.7.10/src/Gateways/PixGateway.php#L358
https://plugins.trac.wordpress.org/browser/woocommerce-mercadopago/tags/8.7.10/src/Gateways/PixGateway.php#L92
https://plugins.trac.wordpress.org/changeset?old_path=%2Fwoocommerce-mercadopago/tags/8.7.11&new_path=%2Fwoocommerce-mercadopago/tags/8.7.12
https://www.wordfence.com/threat-intel/vulnerabilities/id/986e0252-b94d-4ac8-9083-0218fa8a651e?source=cve

Configurations

No configuration.

History

25 Jul 2026, 11:10

Type	Values Removed	Values Added
Summary		(es) El plugin de pagos de Mercado Pago para WooCommerce para WordPress es vulnerable a acceso no autorizado a datos debido a una verificación de capacidad faltante en el endpoint de la API de WooCommerce 'mp_pix_image' en todas las versiones hasta, e incluyendo, la 8.7.11. Esto hace posible que atacantes no autenticados recuperen imágenes de códigos QR de pago PIX para pedidos arbitrarios. Los códigos QR PIX contienen información sensible del comerciante, incluyendo claves PIX (que pueden ser identificadores personales CPF/CNPJ), montos de transacción, nombre y ciudad del comerciante, y referencias de transacción de MercadoPago.

06 May 2026, 04:16

Type	Values Removed	Values Added
New CVE

Information

Published : 2026-05-06 04:16

Updated : 2026-07-25 11:10

NVD link : CVE-2026-3208

Mitre link : CVE-2026-3208

CVE.ORG link : CVE-2026-3208

JSON object : View

Products Affected

No product.

CWE

CWE-862

Missing Authorization

{"id": "CVE-2026-3208", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-3208", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-05-06T12:20:50.759573Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security@wordfence.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 1.4, "exploitabilityScore": 3.9}]}, "affected": [{"source": "security@wordfence.com", "affectedData": [{"vendor": "mercadopago", "product": "Mercado Pago payments for WooCommerce", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "8.7.11"}], "defaultStatus": "unaffected"}]}], "published": "2026-05-06T04:16:06.223", "references": [{"url": "https://plugins.trac.wordpress.org/browser/woocommerce-mercadopago/tags/8.7.10/src/Gateways/PixGateway.php#L358", "source": "security@wordfence.com"}, {"url": "https://plugins.trac.wordpress.org/browser/woocommerce-mercadopago/tags/8.7.10/src/Gateways/PixGateway.php#L92", "source": "security@wordfence.com"}, {"url": "https://plugins.trac.wordpress.org/changeset?old_path=%2Fwoocommerce-mercadopago/tags/8.7.11&new_path=%2Fwoocommerce-mercadopago/tags/8.7.12", "source": "security@wordfence.com"}, {"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/986e0252-b94d-4ac8-9083-0218fa8a651e?source=cve", "source": "security@wordfence.com"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "security@wordfence.com", "description": [{"lang": "en", "value": "CWE-862"}]}], "descriptions": [{"lang": "en", "value": "The Mercado Pago payments for WooCommerce plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'mp_pix_image' WooCommerce API endpoint in all versions up to, and including, 8.7.11. This makes it possible for unauthenticated attackers to retrieve PIX payment QR code images for arbitrary orders. PIX QR codes contain sensitive merchant information including PIX keys (which may be CPF/CNPJ personal identifiers), transaction amounts, merchant name and city, and MercadoPago transaction references."}, {"lang": "es", "value": "El plugin de pagos de Mercado Pago para WooCommerce para WordPress es vulnerable a acceso no autorizado a datos debido a una verificaci\u00f3n de capacidad faltante en el endpoint de la API de WooCommerce 'mp_pix_image' en todas las versiones hasta, e incluyendo, la 8.7.11. Esto hace posible que atacantes no autenticados recuperen im\u00e1genes de c\u00f3digos QR de pago PIX para pedidos arbitrarios. Los c\u00f3digos QR PIX contienen informaci\u00f3n sensible del comerciante, incluyendo claves PIX (que pueden ser identificadores personales CPF/CNPJ), montos de transacci\u00f3n, nombre y ciudad del comerciante, y referencias de transacci\u00f3n de MercadoPago."}], "lastModified": "2026-07-25T11:10:00.100", "sourceIdentifier": "security@wordfence.com"}