What is the CVSS score of CVE-2026-18059?

CVE-2026-18059 has a CVSS 3.1 base score of 5.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.3%.

Is there a patch available for CVE-2026-18059?

Yes, a patch is available for CVE-2026-18059. Update the affected software to the latest version immediately.

PixelYourSite CVE-2026-18059

EUVD-2026-51760 MEDIUM

Information Exposure (CWE-200)

2026-08-01 Wordfence

GHSA-xf2j-qr39-56f9

WordPress Information Disclosure Google Pixelyoursite Wordpress Plugin Pixelyoursite Pro Your Smart Pixel Tag Manager Pixelyoursite Your Smart Pixel Tag Api Manager

5.3

CVSS 3.1 · Vendor: Wordfence

Severity by source

Vendor (Wordfence) PRIMARY

5.3 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

vuln.today AI

5.3 MEDIUM

Network-exploitable with no authentication or user interaction; only confidentiality is affected at low severity; scope unchanged as impact is confined to the vulnerable component's data.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (Wordfence).

CVSS VectorVendor: Wordfence

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Patch available

Aug 01, 2026 - 09:01 EUVD

Analysis Generated

Aug 01, 2026 - 08:51 vuln.today

CVE Published

Aug 01, 2026 - 07:49 cve.org

MEDIUM 5.3

DescriptionCVE.org

The PixelYourSite - Your smart PIXEL (TAG) & API Manager plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 11.2.1 via the getWooPurchaseEventParams. This makes it possible for unauthenticated attackers to extract WooCommerce purchase metadata - including product names, product IDs, quantities, per-item prices, order totals, currency, and order/transaction IDs - for any existing order by supplying an invalid or arbitrary order key. This is exploitable against any known or enumerated order ID, as the plugin resolves the order from the URL path variable alone and emits the full woo_purchase tracking payload into the page HTML via the pysOptions JavaScript object across its Facebook, Google Analytics, and Google Tag Manager integrations regardless of key validity.

AnalysisAI

Sensitive WooCommerce order data exposure in the PixelYourSite WordPress plugin (all versions through 11.2.1) allows unauthenticated remote attackers to retrieve full purchase metadata - product names, quantities, per-item prices, order totals, currency, and transaction IDs - for any order by supplying an arbitrary or invalid order key alongside a known order ID. The plugin's getWooPurchaseEventParams function resolves orders solely from the URL path order ID without validating the accompanying key, then emits the complete woo_purchase tracking payload directly into rendered page HTML via the pysOptions JavaScript object across all three supported integrations (Facebook Pixel, Google Analytics, and Google Tag Manager). No public exploit has been identified at time of analysis, but because WooCommerce order IDs are sequential integers by default, mass enumeration of the entire order history requires only a trivial HTTP loop.

Technical ContextAI

PixelYourSite is a WordPress plugin that orchestrates marketing tracking pixels and conversion tags for Facebook, Google Analytics, and Google Tag Manager, with deep WooCommerce integration for purchase event firing. The vulnerable function getWooPurchaseEventParams, defined in includes/functions-woo.php (L244) and invoked from three integration modules - modules/facebook/facebook.php (L696), modules/google_analytics/ga.php (L843), and modules/google_gtm/gtm.php (L1083) - and from the core class-pys.php (L1112), fetches WooCommerce order objects using only the numeric order ID extracted from the URL path. WooCommerce natively protects order-received pages with a unique per-order key (a cryptographic nonce) that the platform enforces to prevent unauthorized access; by resolving the order without verifying that the supplied key matches, the plugin entirely bypasses this protection. The complete purchase tracking payload is then serialized into the pysOptions JavaScript variable and injected into the page HTML on the server side, making it accessible to any HTTP client without a browser. Two CPE strings cover the affected surface: cpe:2.3:a:pixelyoursite:pixelyoursite_-_your_smart_pixel_(tag)_&_api_manager:*:*:*:*:*:*:*:* (free tier) and cpe:2.3:a:pixelyoursite:pixelyoursite_pro_-_your_smart_pixel_(tag)_manager:*:*:*:*:*:*:*:* (Pro tier). CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor) precisely describes the root cause: a data-retrieval path that serves private business and transaction records to unauthenticated parties due to missing authorization checks.

RemediationAI

Update PixelYourSite (both free and Pro editions) to a version higher than 11.2.1. A code fix has been committed to the WordPress plugin SVN repository (https://plugins.trac.wordpress.org/changeset?reponame=&old=3629756%40pixelyoursite&new=3629756%40pixelyoursite), but a specific patched release version number is not independently confirmed from the available data - verify the current release version in the official WordPress plugin directory before upgrading and confirm it is numbered above 11.2.1. As a compensating control where immediate patching is not possible, restrict unauthenticated access to WooCommerce order-received URLs (typically /checkout/order-received/) at the web server or WAF layer; note this may interfere with legitimate post-purchase confirmation page delivery and should be tested against the checkout flow before deployment. Additionally, implementing rate-limiting on requests to order-received endpoints can slow automated sequential enumeration without blocking legitimate traffic. Operators subject to GDPR, CCPA, or PCI DSS should assess whether order data surfaced prior to patching constitutes a reportable data exposure event.