The Mercado Pago payments for WooCommerce plugin contains a missing capability check on the mp_pix_image WooCommerce API endpoint. This flaw allows attackers who are not authenticated to retrieve PIX payment QR code images for any order. The QR codes expose sensitive merchant data, such as PIX keys that may contain CPF/CNPJ personal identifiers, transaction amounts, merchant name, city, and MercadoPago transaction references. The vulnerability is a direct instance of missing authorization (CWE‑862).

All installations of the Mercado Pago payments for WooCommerce plugin for WordPress with a version of 8.7.11 or earlier are affected. The issue is limited to the mp_pix_image endpoint within the plugin’s codebase.

The vulnerability has a CVSS score of 5.3, indicating moderate severity. The EPSS score is not available, and the flaw is not listed in the CISA KEV catalog. The likely attack vector is a simple HTTP request to the /mp_pix_image endpoint without any authentication. Because the endpoint returns the QR code image directly, an attacker only needs network access to the site to obtain the data; no additional credentials or privilege escalation is required. The consequence is the unauthorized exposure of confidential payment information, which could lead to financial and privacy impacts.