Unauthorized Data Access in Mercado Pago Payments Plugin for WordPress

CVE-2026-3208

What is CVE-2026-3208?

The Mercado Pago payments plugin for WooCommerce is susceptible to unauthorized data access due to a lack of capability checks on the 'mp_pix_image' API endpoint. This vulnerability allows attackers to exploit the WooCommerce plugin across all versions up to 8.7.11, potentially retrieving sensitive PIX payment QR code images associated with any order. These QR codes can reveal critical merchant information, including PIX keys, which may contain CPF/CNPJ personal identifiers, transaction amounts, and merchant details. This issue emphasizes the necessity for robust security practices in payment processing plugins to protect sensitive data against unauthorized queries.

References