PixelYourSite CVE-2026-18059

The vulnerability is exploitable when: the target WordPress site has PixelYourSite (free or Pro) version 11.2.1 or earlier installed and active; WooCommerce is installed with at least one recorded order; and at least one of the plugin's WooCommerce tracking integrations (Facebook Pixel, Google Analytics, or Google Tag Manager) is enabled in the plugin settings. The attacker requires only a valid numeric WooCommerce order ID - no authentication, cookie, session token, or special network position is needed. Because WooCommerce assigns order IDs as sequential integers starting from a low base value, an attacker can enumerate them by incrementing from 1 without any prior knowledge of the target store. Sites with no WooCommerce orders present, or sites where PixelYourSite's WooCommerce tracking integrations are entirely disabled in plugin configuration, are not exploitable. There is no user interaction or victim action required.

The CVSS 3.1 base score of 5.3 (Medium) with vector AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N accurately encodes the technical mechanics - network-accessible, zero-complexity, zero-privilege exploitation with no user interaction - but the CVSS impact rating of C:L materially understates the realistic business consequence for e-commerce operators. The exposed data set - item names, quantities, unit prices, totals, currency, and transaction IDs across the store's entire order history - may constitute personal data under GDPR and CCPA and could implicate PCI DSS obligations, elevating organizational risk well above what a 5.3 score suggests. The vulnerability is not listed in the CISA KEV catalog and no EPSS probability was provided in the available data, indicating no confirmed large-scale exploitation at time of analysis. However, the attack complexity is genuinely minimal: WooCommerce order IDs are sequential integers, no authentication or session token is needed, and the response parsing is trivially scriptable. The gap between the moderate CVSS score and the real-world data sensitivity risk is significant - security and compliance teams should treat this as higher priority than the score alone implies for any WooCommerce store processing real customer orders.

An attacker scripted to enumerate WooCommerce order IDs sends sequential HTTP GET requests to the site's order-received URL (e.g., /checkout/order-received/1001/ through /checkout/order-received/9999/) with a blank or random order_key query parameter. Because PixelYourSite resolves each order from the numeric path segment alone and ignores key validity, the plugin injects the full woo_purchase payload into the HTML of every response, which the attacker parses to reconstruct a structured dataset of the store's transaction history - item names, quantities, prices, totals, and transaction IDs - across all affected orders. No public exploit code has been identified at time of analysis, but the exploit logic requires only a basic HTTP client and a counter loop.