PT-2026-37341 · WordPress · Mercado Pago Payments For Woocommerce

Muhammad Sharief · Published 2026-05-06 · Updated 2026-05-06 · CVE-2026-3208

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Mercado Pago payments for WooCommerce versions prior to 8.7.12

Description The Mercado Pago payments for WooCommerce plugin for WordPress allows unauthorized access to data because of a missing capability check on the 'mp pix image' API endpoint. This allows unauthenticated attackers to retrieve PIX payment QR code images for arbitrary orders. These images contain sensitive merchant information, including PIX keys (which may be CPF/CNPJ personal identifiers), transaction amounts, merchant name, city, and MercadoPago transaction references.

Recommendations Update the plugin to a version later than 8.7.11. As a temporary workaround, restrict access to the 'mp pix image' API endpoint to minimize the risk of exploitation.

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2026-3208

Affected Products

Mercado Pago Payments For Woocommerce

References · 11

• https://nvd.nist.gov/vuln/detail/CVE-2026-3208 · Security Note
• https://plugins.trac.wordpress.org/browser/woocommerce-mercadopago/tags/8.7.10/src/Gateways/PixGateway.php#L358 · Note
• https://t.me/CVEtracker/52814 · Telegram Post
• https://twitter.com/CVEnew/status/2051928703572304019 · Twitter Post
• https://t.me/cveNotify/162284 · Telegram Post
• https://wordfence.com/threat-intel/vulnerabilities/id/986e0252-b94d-4ac8-9083-0218fa8a651e?source=cve · Note
• https://t.me/cveNotify/162319 · Telegram Post
• https://twitter.com/VulmonFeeds/status/2051931065732747624 · Twitter Post
• https://plugins.trac.wordpress.org/changeset?old_path=%2Fwoocommerce-mercadopago/tags/8.7.11&new_path=%2Fwoocommerce-mercadopago/tags/8.7.12 · Note
• https://plugins.trac.wordpress.org/browser/woocommerce-mercadopago/tags/8.7.10/src/Gateways/PixGateway.php#L92 · Note
• https://twitter.com/infoflowcloud/status/2051930103668490250 · Twitter Post