CVE-2026-3208

MediumCVSS 5.3/10Last modified Jul 25, 2026

Description

The Mercado Pago payments for WooCommerce plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'mp_pix_image' WooCommerce API endpoint in all versions up to, and including, 8.7.11. This makes it possible for unauthenticated attackers to retrieve PIX payment QR code images for arbitrary orders. PIX QR codes contain sensitive merchant information including PIX keys (which may be CPF/CNPJ personal identifiers), transaction amounts, merchant name and city, and MercadoPago transaction references.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-862

Affected software

No affected versions have been published.

Timeline

Published
May 6, 2026
Last modified
Jul 25, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-320807.0Use after free in Windows WalletService allows an authorized attacker to elevate privileges locally.CVE-2026-320815.5Exposure of sensitive information to an unauthorized actor in Windows File Explorer allows an authorized attacker to disclose information loCVE-2026-320827.0Concurrent execution using shared resource with improper synchronization ('race condition') in Windows SSDP Service allows an authorized attCVE-2026-320837.0Concurrent execution using shared resource with improper synchronization ('race condition') in Windows SSDP Service allows an authorized attCVE-2026-320845.5Exposure of sensitive information to an unauthorized actor in Windows File Explorer allows an authorized attacker to disclose information loCVE-2026-320855.5Exposure of sensitive information to an unauthorized actor in Windows Remote Procedure Call allows an authorized attacker to disclose informCVE-2026-320867.0Concurrent execution using shared resource with improper synchronization ('race condition') in Function Discovery Service (fdwsd.dll) allowsCVE-2026-320877.0Heap-based buffer overflow in Function Discovery Service (fdwsd.dll) allows an authorized attacker to elevate privileges locally.CVE-2026-320885.7Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Biometric Service allows an unauthoriCVE-2026-320897.8Use after free in Windows Speech Brokered Api allows an authorized attacker to elevate privileges locally.CVE-2026-32096.3A vulnerability has been found in fosrl Pangolin up to 1.15.4-s.3. This affects the function verifyRoleAccess/verifyApiKeyRoleAccess of the CVE-2026-320907.0Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Speech Brokered Api allows an authori