CVE-2024-7870 MEDIUM

CVE-2024-7870: PixelYourSite – Your smart PIXEL (TAG) & API Manager <= 9.7.1 and PixelYourSite PRO <= 10.4.2 - Unauthenticated Information Exposure and Log Deletion

Vendor Pixelyoursite
Product PixelYourSite – Your smart PIXEL (TAG) & API Manager
Weakness CWE-287 · Improper authentication
Published September 4, 2024
Last update April 8, 2026
View on NVD All CVEs

CVSS base score

6.5/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction None
Confidentiality Low
Integrity Low

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

What the vulnerability does

01Description

The PixelYourSite – Your smart PIXEL (TAG) & API Manager and the PixelYourSite PRO plugins for WordPress are vulnerable to Sensitive Information Exposure in all versions up to, and including, 9.7.1 and 10.4.2, respectively, through publicly exposed log files. This makes it possible for unauthenticated attackers to view potentially sensitive information contained in the exposed log files, and to delete log files.

Explanation of Vulnerability in Simple Terms

02Summary

PixelYourSite versions up to 9.7.1 contain an authentication bypass vulnerability. An attacker can access sensitive functionality without valid credentials by exploiting improper authentication checks. This allows unauthorized modification of pixel and API configurations. Site owners should update immediately to a version newer than 9.7.1.

What an attacker can do

03Attacker Capabilities

Access and modify pixel and API manager settings without authentication.

Potential impact on your site

04Site Impact

Attackers can alter tracking pixels and API configurations, potentially redirecting data or injecting malicious code.

Conditions required to exploit

05Prerequisites

Network access only; no authentication or user interaction required.

Key dates

06Disclosure timeline

September 4, 2024 CVE published
April 8, 2026 Record updated