EUVD-2026-51707
GHSA-9mjw-584w-6228
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Network-accessible AJAX endpoint, no auth required (PR:N), integrity impact from forged events (I:L), minor confidentiality impact from credential misuse (C:L), no availability impact.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
Lifecycle Timeline
5DescriptionCVE.org
The Pixel Tag Manager for WooCommerce WordPress plugin before 2.2.1 does not perform an authorization check on one of its AJAX actions, allowing unauthenticated users to submit forged e-commerce conversion events to the site's configured server-side advertising conversion APIs using the site's stored credentials.
AnalysisAI
Unauthenticated forged conversion event injection in Pixel Tag Manager for WooCommerce (all versions before 2.2.1) allows any remote attacker to submit fabricated e-commerce conversion events to the site's server-side advertising APIs - such as Meta Conversions API or Google Ads - using the site's own stored credentials. The root cause is a missing authorization check on a WordPress AJAX action (CWE-284), meaning the endpoint processes requests from anyone without verifying identity or role. A publicly available exploit exists per WPScan; however, the EPSS score of 0.14% (4th percentile) indicates opportunistic exploitation has not yet been observed at scale.
Technical ContextAI
WordPress plugins register AJAX handlers via wp_ajax_ (authenticated) or wp_ajax_nopriv_ (unauthenticated) hooks in wp-admin/admin-ajax.php. This plugin incorrectly registered a conversion-event submission handler without role or capability verification, meaning it is reachable as wp_ajax_nopriv_, or a nonce/capability check is entirely absent. The plugin implements server-side conversion tracking - where the WooCommerce backend, rather than the browser, sends purchase event data directly to advertising platforms (e.g., Meta CAPI, Google Ads Enhanced Conversions) using stored API tokens or pixel credentials. The affected CPE is cpe:2.3:a:unknown:pixel_tag_manager_for_woocommerce:*:*:*:*:*:*:*:* covering all versions prior to 2.2.1. CWE-284 (Improper Access Control) identifies the root cause as a failure to enforce authorization boundaries at the action handler level.
RemediationAI
Update Pixel Tag Manager for WooCommerce to version 2.2.1 or later, which is the vendor-released patch that introduces the missing authorization check on the affected AJAX action. The fix can be applied via the WordPress admin dashboard under Plugins > Installed Plugins > Update, or via WP-CLI with 'wp plugin update'. Full advisory details are available at https://wpscan.com/vulnerability/0d7c113a-b677-4687-a077-ec0ec7deff83/. If immediate patching is not feasible, a compensating control is to deactivate the plugin entirely until the update can be applied - this prevents the AJAX endpoint from being registered at all and eliminates the attack surface with no side effect other than disabling pixel tracking. Alternatively, a WAF rule blocking unauthenticated POST requests to wp-admin/admin-ajax.php for this plugin's specific action parameter can reduce exposure, though this requires knowing the specific action name (inspect plugin source to identify it). Rotating all stored advertising API credentials after patching is advisable if exploitation cannot be ruled out.
Same weakness CWE-284 – Improper Access Control
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today