CVE-2025-12545
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk21th percentile - higher than 21% of all known CVEs
Summary
The Pixel Manager for WooCommerce – Track Conversions and Analytics, Google Ads, TikTok and more plugin for WordPress is vulnerable to Information Exposure in all versions up to and including 1.49.2 via the ajax_pmw_get_product_ids() function. Due to insufficient restrictions on which products can be included, unauthenticated attackers can extract data from password-protected, private, or draft products.
Risk Assessment
Unauthenticated attackers can access product data that should be hidden (private, password-protected, drafts), potentially breaching confidentiality of business information.
Recommendation
Update the Pixel Manager for WooCommerce plugin to a version later than 1.49.2. Until then, consider restricting access to the AJAX endpoint or disabling the plugin.
Other vulnerabilities in Pixel Manager for WooCommerce
See all- CVE-2026-94674Medium
Cross Site Scripting (XSS) vulnerability in Pixel Manager for WooCommerce up to version 1.69.0. A user with Contributor role can inject malicious script.
- CVE-2025-67564Medium
The Pixel Manager for WooCommerce plugin (woocommerce-google-adwords-conversion-tracking-tag) by alekv in versions up to, and including, 1.51.1 is vulnerable to exposure of sensitive system information to an unauthorized control sphere. This may allow retrieval of embedded sensitive data.
Original NVD description (English source)
The Pixel Manager for WooCommerce – Track Conversions and Analytics, Google Ads, TikTok and more plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 1.49.2 via the ajax_pmw_get_product_ids() function due to insufficient restrictions on which products can be included. This makes it possible for unauthenticated attackers to extract data from password protected, private, or draft products that they should not have access to.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS