CVE-2026-3208 — The Mercado Pago payments for WooCommerce plugin for

title: CVE-2026-3208 - Mercado Pago WooCommerce PIX QR Code Image Retrieval
id: scw-2026-05-06-ai-1
status: experimental
level: high
description: |
  Detects attempts to access the vulnerable '/wp-json/mercado-pago/v1/mp_pix_image' endpoint in the Mercado Pago WooCommerce plugin. This specific path is used to retrieve PIX QR code images, and the vulnerability allows unauthenticated access to sensitive merchant and transaction data.
author: SCW Feed Engine (AI-generated)
date: 2026-05-06
references:
  - https://shimiscyberworld.com/posts/nvd-CVE-2026-3208/
tags:
  - attack.initial_access
  - attack.t1190
logsource:
    category: webserver
detection:
  selection:
      cs-uri|contains:
          - '/wp-json/mercado-pago/v1/mp_pix_image'
      cs-method:
          - 'GET'
  condition: selection
falsepositives:
  - Legitimate administrative activity

Source: Shimi's Cyber World · License & reuse