WordPress security changelog
MEDIUM CVE-2026-18059 Received

PixelYourSite exposes WooCommerce purchase metadata without a valid order key

PixelYourSite through 11.2.1 resolves an order from the URL path alone in getWooPurchaseEventParams() and emits its woo_purchase payload into pysOptions even when the supplied order key is invalid. An unauthenticated visitor who knows or enumerates an order ID can obtain product names and IDs, quantities, prices, totals, currency and order or transaction IDs.

CVE / CNA score 5.3 CVSS 3.1 · security@wordfence.com
NVD score Pending NVD has not published its own CVSS assessment.
Component
PixelYourSite – Your smart PIXEL (TAG) & API Manager, PixelYourSite Pro – Your smart PIXEL (TAG) Manager
Plugin slug
pixelyoursite
Affected
<= 11.2.1, < 12.6.1
Safe version
12.6.1
Published
Aug 01, 2026
Weakness
CWE-200 — Exposure of Sensitive Information to an Unauthorized Actor

This CVE was published Aug 01, 2026 and is one of 12 known issues for this plugin.

What to do

Update, patch or deactivate.

Update PixelYourSite to 12.6.1 or later. Review order-received traffic with invalid keys, determine which orders were exposed, and handle disclosed purchase data according to privacy obligations.

A safe version is available, so updating to that version or later is the preferred remediation. If an immediate update is not practical, consider a targeted application patch or temporarily restricting the affected functionality.

Deactivate only when warranted by your risk profile, or when advised by your hosting provider in the limited circumstances where the vulnerability cannot otherwise be mitigated. If you’re unsure which action is appropriate, contact Fused or your hosting provider for guidance.

Source record

Technical description

The PixelYourSite – Your smart PIXEL (TAG) & API Manager plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 11.2.1 via the getWooPurchaseEventParams. This makes it possible for unauthenticated attackers to extract WooCommerce purchase metadata — including product names, product IDs, quantities, per-item prices, order totals, currency, and order/transaction IDs — for any existing order by supplying an invalid or arbitrary order key. This is exploitable against any known or enumerated order ID, as the plugin resolves the order from the URL path variable alone and emits the full woo_purchase tracking payload into the page HTML via the pysOptions JavaScript object across its Facebook, Google Analytics, and Google Tag Manager integrations regardless of key validity.

CVE / CNA vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

References

Primary and upstream sources