CVE-2026-14315

MediumCVSS 6.5

Published: 01/08/2026(UTC)Updated: 26/08/2026(UTC)Translated: 01/08/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.16%

6th percentile - higher than 6% of all known CVEs

Summary

The Pixel Tag Manager for WooCommerce WordPress plugin before version 2.2.1 does not perform an authorization check on one of its AJAX actions, allowing unauthenticated users to submit forged e-commerce conversion events to the site's configured server-side advertising conversion APIs using the site's stored credentials.

Risk Assessment

An attacker can generate fake conversion events, leading to incorrect analytics data, improper billing with advertising platforms, and potential financial losses.

Recommendation

Update the Pixel Tag Manager for WooCommerce plugin to version 2.2.1 or later, which adds the required authorization.

Other vulnerabilities in Pixel Tag Manager for WooCommerce WordPress plugin

CVE-2026-105199Medium
The Pixel Tag Manager for WooCommerce WordPress plugin before version 2.2.3 does not perform a capability check in one of its AJAX actions, and exposes the nonce protecting it to any user able to access the admin dashboard. This allows users with a role as low as Contributor to overwrite the plugin's tracking configuration and have arbitrary JavaScript executed in the browsers of all visitors, including administrators.

Original NVD description (English source)

The Pixel Tag Manager for WooCommerce WordPress plugin before 2.2.1 does not perform an authorization check on one of its AJAX actions, allowing unauthenticated users to submit forged e-commerce conversion events to the site's configured server-side advertising conversion APIs using the site's stored credentials.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS