Description
The Pixel Tag Manager for WooCommerce WordPress plugin before 2.2.1 does not perform an authorization check on one of its AJAX actions, allowing unauthenticated users to submit forged e-commerce conversion events to the site's configured server-side advertising conversion APIs using the site's stored credentials.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | Pixel Tag Manager for WooCommerce | < 2.2.1 | 2.2.1 |
References
- https://wpscan.com/vulnerability/0d7c113a-b677-4687-a077-ec0ec7deff83/ exploit vdb-entry technical-description