What is the CVSS score of CVE-2026-3208?

CVE-2026-3208 has a CVSS 3.1 base score of 5.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.0%.

Mercado Pago for WooCommerce CVE-2026-3208

EUVD-2026-27520 MEDIUM

Missing Authorization (CWE-862)

2026-05-06 Wordfence

GHSA-cfhj-895c-686j

Authentication Bypass WordPress

5.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

5.3 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

May 06, 2026 - 04:30 vuln.today

DescriptionCVE.org

The Mercado Pago payments for WooCommerce plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'mp_pix_image' WooCommerce API endpoint in all versions up to, and including, 8.7.11. This makes it possible for unauthenticated attackers to retrieve PIX payment QR code images for arbitrary orders. PIX QR codes contain sensitive merchant information including PIX keys (which may be CPF/CNPJ personal identifiers), transaction amounts, merchant name and city, and MercadoPago transaction references.

AnalysisAI

Unauthenticated attackers can retrieve PIX payment QR code images for arbitrary WooCommerce orders via the unprotected 'mp_pix_image' API endpoint in Mercado Pago payments for WooCommerce plugin versions up to 8.7.11, exposing sensitive merchant data including PIX keys, transaction amounts, merchant identity, and Mercado Pago transaction references. The vulnerability requires no authentication, user interaction, or special configuration, and exploits a missing capability check in the WordPress REST API handler. No public exploit code or active exploitation has been confirmed at the time of analysis.

Technical ContextAI

The Mercado Pago for WooCommerce plugin implements a custom WordPress REST API endpoint 'mp_pix_image' to serve dynamically generated PIX QR codes for payment confirmation. PIX is Brazil's instant payment system, and QR codes encode merchant payment details including the merchant's PIX key (which may be a CPF or CNPJ personal identifier), transaction amount, merchant name and location, and Mercado Pago reference identifiers. The vulnerability stems from CWE-862 (Missing Authorization), where the endpoint handler fails to call WordPress capability checking functions (such as current_user_can()) before processing requests and returning sensitive image data. The endpoint accepts arbitrary order identifiers without validating whether the requesting user has permission to view that specific order, allowing unauthenticated users to enumerate and retrieve QR codes for any order in the system. The affected code path includes the PixGateway.php handler which constructs and serves the image response without proper access controls.

RemediationAI

Update Mercado Pago payments for WooCommerce to version 8.7.12 or later immediately. Administrators should navigate to Plugins → Installed Plugins in WordPress, locate 'Mercado Pago payments for WooCommerce,' and click 'Update' to patch the missing authorization check. If immediate patching is not possible, consider temporarily disabling the WooCommerce REST API using a plugin such as Disable REST API or by adding a security rule to restrict access to /wp-json/wc/v3/* endpoints to authenticated users only via WordPress security plugins (e.g., Wordfence, Sucuri) or web application firewall rules. Note that restricting REST API access may affect legitimate WooCommerce mobile apps and integrations, so this should be a temporary measure. Additionally, review WooCommerce order logs to identify if unauthorized access to order QR codes occurred, and monitor for suspicious activity patterns (multiple rapid requests to mp_pix_image with varying order IDs). For organizations unable to patch immediately, implement network-level access controls to restrict REST API access by IP address or geographic region.