Threats tagged 'ghsa-cfhj-895c-686j'

The Mercado Pago payments for WooCommerce plugin for WordPress contains a vulnerability in all versions up to and including 8.7.11. The flaw is due to a missing capability check on the 'mp_pix_image' WooCommerce API endpoint, allowing unauthenticated attackers to access PIX payment QR code images for arbitrary orders. These QR codes expose sensitive merchant information such as PIX keys (which may include personal identifiers like CPF/CNPJ), transaction amounts, merchant name and city, and MercadoPago transaction references.