Signal is active with 3 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
The Mercado Pago payments for WooCommerce plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'mp_pix_image' WooCommerce API endpoint in all versions up to, and including, 8.7.11. This makes it possible for unauthenticated attackers to retrieve PIX payment QR code images for arbitrary orders. PIX QR codes contain sensitive merchant information including PIX keys (which may be CPF/CNPJ personal identifiers), transaction amounts, merchant name and city, and MercadoPago transaction references.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
NONE
CVE-2026-3208 The Mercado Pago payments for WooCommerce plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'mp_pix_image' WooC… https://www.cve.org/CVERecord?id=CVE-2026-3208
Post summary
A missing capability check in the Mercado Pago WooCommerce plugin allows unauthorized data access (CVE-2026-3208). No PoC, exploit, or patch information is provided.
CVE-2026-3208 Unauthenticated Data Access in Mercado Pago WooCommerce Pl... https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-3208 Don't wait vulnerability scanning results: https://alerts.vulmon.com/?utm_source=twitter&utm_medium=social&utm_campaign=2102281&utm_content=2
Post summary
The tweet links to a vulnerability detail page for CVE‑2026‑3208 and promotes vulnerability scanning, but provides no additional technical or exploit information.
🚨*CVE* CVE-2026-3208 The Mercado Pago payments for WooCommerce plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'mp_pix_image' WooC… https://www.cve.org/CVERecord?id=CVE-2026-3208 ----- Traducción: CVE-2026-3208 Los… http://infoflow.cloud`
Post summary
The post announces CVE-2026-3208, noting that the Mercado Pago WooCommerce plugin lacks a capability check, allowing unauthorized data access. No exploitation details, patch information, or PoC are provided.