Mercado Pago Payments for WooCommerce Missing Authorization Vulnerability Allowing Unauthenticated Data Access

A vulnerability exists in the Mercado Pago payments for WooCommerce plugin for WordPress, specifically in versions through 8.7.11. The issue arises from a missing capability check on the 'mp_pix_image' WooCommerce API endpoint, which allows unauthenticated attackers to access PIX payment QR code images for any order. These QR codes contain sensitive merchant information, including PIX keys (potentially linked to personal identifiers), transaction amounts, merchant details, and MercadoPago transaction references.

Impact

Exploitation of this vulnerability could lead to unauthorized access to sensitive merchant information, including personal identifiers, transaction details, and payment references.

Remediation

Users are advised to update the plugin to version 8.7.12 or a newer patched version.