Vulnerabilities ›

CVE-2026-3208

Medium

CWE-862 — Weakness Type

                    Published: May 6, 2026                      ·  Modified: May 9, 2026                      ·  Source: NVD                

CVSS v3

5.3

🔗 NVD Official

📄 Description (English)

The Mercado Pago payments for WooCommerce plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'mp_pix_image' WooCommerce API endpoint in all versions up to, and including, 8.7.11. This makes it possible for unauthenticated attackers to retrieve PIX payment QR code images for arbitrary orders. PIX QR codes contain sensitive merchant information including PIX keys (which may be CPF/CNPJ personal identifiers), transaction amounts, merchant name and city, and MercadoPago transaction references.

🤖 AI Executive Summary

The Mercado Pago WooCommerce plugin contains a missing capability check vulnerability allowing unauthenticated attackers to access PIX payment QR code images containing sensitive merchant data. This exposure affects all versions up to 8.7.11 and could lead to unauthorized disclosure of merchant identifiers and transaction information.

📄 Description (Arabic)

ثغرة في مكون Mercado Pago للدفع عبر WooCommerce تسمح للمهاجمين غير المصرح لهم بالوصول إلى صور رموز QR الخاصة بدفعات PIX التي تحتوي على معلومات حساسة عن التاجر. تتضمن البيانات المكشوفة مفاتيح PIX وأرقام تعريف شخصية وأسماء التجار والمدن والمراجع المالية. يؤثر هذا على جميع الإصدارات حتى 8.7.11.

🤖 ملخص تنفيذي (AI)

A missing authentication check in the Mercado Pago WooCommerce plugin allows unauthorized users to retrieve sensitive PIX QR code images containing merchant personal identifiers and transaction details. This vulnerability affects e-commerce platforms using the plugin for payment processing in versions 8.7.11 and earlier.

🤖 AI Intelligence Analysis Analyzed: May 29, 2026 15:03

🇸🇦 Saudi Arabia Impact Assessment

Saudi Relevance: high

🏢 Affected Saudi Sectors

banking telecom government

🎯 MITRE ATT&CK Techniques

T1078.001 T1526 T1087

⚖️ Saudi Risk Score (AI)

6.0

/ 10.0

🔧 Remediation Steps (English)

Update the Mercado Pago payments for WooCommerce plugin to version 8.7.12 or later immediately. Implement proper capability checks on the 'mp_pix_image' API endpoint to require authentication. Review access logs for unauthorized API calls to the endpoint. Consider implementing additional API rate limiting and IP whitelisting for payment-related endpoints.

🔧 خطوات المعالجة (العربية)

قم بتحديث مكون Mercado Pago للدفع في WooCommerce إلى الإصدار 8.7.12 أو أحدث فوراً. تطبيق فحوصات القدرات المناسبة على نقطة نهاية API 'mp_pix_image' لتتطلب المصادقة. مراجعة سجلات الوصول للكشف عن استدعاءات API غير المصرح بها. النظر في تطبيق تحديد معدل إضافي وقائمة بيضاء للعناوين لنقاط نهاية الدفع.

📋 Regulatory Compliance Mapping

🟢 NCA ECC 2024

5.1.1 5.2.1 5.3.1

🔵 SAMA CSF

AC-2 AC-3 SI-4

🟡 ISO 27001:2022

A.9.1.1 A.9.2.1 A.9.4.3

🔗 References & Sources 4

🔗

https://plugins.trac.wordpress.org/browser/woocommerce-mercadopago/tags/8.7.10/src/Gate...

security@wordfence.com

🔗

https://plugins.trac.wordpress.org/browser/woocommerce-mercadopago/tags/8.7.10/src/Gate...

security@wordfence.com

🔗

https://plugins.trac.wordpress.org/changeset?old_path=%2Fwoocommerce-mercadopago/tags/8...

security@wordfence.com

🔗

https://www.wordfence.com/threat-intel/vulnerabilities/id/986e0252-b94d-4ac8-9083-0218f...

security@wordfence.com

📊 CVSS Score

5.3

/ 10.0 — Medium

📊 CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Attack VectorN — None / Network

Attack ComplexityL — Low / Local

Privileges RequiredN — None / Network

User InteractionN — None / Network

ScopeU — Unchanged

ConfidentialityL — Low / Local

IntegrityN — None / Network

AvailabilityN — None / Network

📋 Quick Facts

Severity Medium

CVSS Score5.3

CWECWE-862

EPSS0.02%

Exploit No

Patch ✗ No

Published 2026-05-06

Source Feed nvd

🇸🇦 Saudi Risk Score

6.0

/ 10.0 — Saudi Risk

Priority: MEDIUM

🏷️ Tags

CWE-862

⚡ Actions

🔗 NVD Official Page ⚡ Exploit-DB Search 🐙 GitHub PoC Search 🎯 MITRE ATT&CK 📊 CVE Details

CVE-2026-3208

Introduce Yourself

Sign In Required