What the vulnerability does
01Description
The Pixel Manager for WooCommerce – Track Conversions and Analytics, Google Ads, TikTok and more plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 1.49.2 via the ajax_pmw_get_product_ids() function due to insufficient restrictions on which products can be included. This makes it possible for unauthenticated attackers to extract data from password protected, private, or draft products that they should not have access to.
Explanation of Vulnerability in Simple Terms
02Summary
The Pixel Manager for WooCommerce plugin versions up to 1.49.2 expose sensitive information that can be accessed over the network without authentication. An attacker can read data that should be restricted, such as tracking tokens or configuration details. Update to a version newer than 1.49.2 to resolve this issue.
What an attacker can do
03Attacker Capabilities
Read sensitive tracking data and configuration information from the plugin without logging in.
Potential impact on your site
04Site Impact
Tracking tokens, API keys, or other sensitive plugin configuration may be exposed to unauthorized parties.
Conditions required to exploit
05Prerequisites
Network access to the site; no authentication or user interaction required.
Key dates
06Disclosure timeline
November 18, 2025
CVE published
April 8, 2026
Record updated
