The vulnerability resides in the ajax_pmw_get_product_ids() function of the Pixel Manager for WooCommerce plugin. It allows an attacker lacking authentication to retrieve product identifiers for items that are password protected, private, or marked as draft. This leads to unintended disclosure of potentially sensitive product data, violating confidentiality. The weakness is classified as CWE-200, indicating an information exposure flaw.

All installations of Pixel Manager for WooCommerce – Conversion Tracking, Google Ads, GA4, TikTok, Dynamic Remarketing with versions up to and including 1.49.2 on WordPress sites are affected. No further version specifications are available; therefore any instance using 1.49.2 or older is vulnerable.

The CVSS score of 5.3 indicates moderate severity, while the EPSS score of <1% suggests a low likelihood of exploitation in the wild. The plugin is not listed in CISA KEV, meaning the vulnerability has not yet been reported as actively exploited. The attack vector is unauthenticated, and an attacker can trigger the exposed AJAX endpoint to gather sensitive product information without needing any credentials.