EUVD-2026-51701
GHSA-gm56-v4px-r8mh
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
API quota exhaustion is a real availability impact at L level; all other metrics match the provided vector as the unauthenticated network path and low complexity are confirmed by the public nonce disclosure.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
Lifecycle Timeline
5DescriptionCVE.org
The Pixelavo WordPress plugin before 1.5.4 registers an unauthenticated AJAX action, gated only by a nonce that it emits publicly on every front-end page, that forwards client-supplied event data to the configured Facebook Conversions API using the administrator's stored access token. This allows an unauthenticated visitor to inject arbitrary conversion events into the administrator's Facebook ads account and exhaust the configured API quota.
AnalysisAI
Unauthenticated server-side request forgery in the Pixelavo WordPress plugin before 1.5.4 allows any visitor to inject arbitrary Facebook conversion events using the site administrator's stored Conversions API access token. The plugin registers an AJAX endpoint protected only by a nonce that is emitted in plaintext on every public page load, rendering the nonce trivially obtainable and the endpoint effectively unprotected. Attackers can poison the administrator's Facebook Ads analytics with fabricated conversion data and exhaust the configured API quota, degrading ad targeting and measurement. A publicly available exploit exists; no confirmed active exploitation (CISA KEV) at time of analysis.
Technical ContextAI
Pixelavo is a WordPress plugin designed to integrate Facebook's server-side Conversions API, forwarding e-commerce event data from the WordPress front-end to Facebook's ad measurement infrastructure. The root cause is classified as CWE-918 (Server-Side Request Forgery): the server makes outbound requests to an external API (Facebook Conversions API) using attacker-controlled input, authenticating those requests with the administrator's stored bearer token. The nonce mechanism - WordPress's standard CSRF mitigation - is rendered inert because the plugin outputs the nonce value in the page source on every front-end page load, making it universally readable by any unauthenticated visitor without needing to inspect protected responses. Affected products per CPE: cpe:2.3:a:unknown:pixelavo:*:*:*:*:*:*:*:* covering all versions prior to 1.5.4.
RemediationAI
Update the Pixelavo plugin to version 1.5.4 or later, which is the vendor-released patch per the WPScan advisory at https://wpscan.com/vulnerability/766c961e-e5aa-4ebe-8107-032f46316f91/. If immediate patching is not possible, disable the Pixelavo plugin entirely to eliminate the exposed AJAX endpoint - this prevents both event injection and API quota exhaustion at the cost of losing Facebook Conversions API integration. As an interim compensating control, site operators can restrict AJAX access via WAF rules blocking POST requests to wp-admin/admin-ajax.php with the specific action parameter associated with Pixelavo's event forwarding endpoint; however, this requires identifying the exact action name from the plugin source. Rotating the Facebook Conversions API access token after patching is advisable if the plugin was previously active and exposed, to invalidate any requests staged using the old token.
Same weakness CWE-918 – Server-Side Request Forgery (SSRF)
View allShare
External POC / Exploit Code
Leaving vuln.today