The Pixel Tag Manager for WooCommerce plugin fails to verify authorization on an AJAX action that records e‑commerce conversion events. As a result, anyone can send forged conversion data to the site’s configured server‑side advertising conversion API using the site’s stored credentials. This allows an attacker to poison advertising metrics, inflate conversion counts, or disrupt campaign reporting without authentication, potentially compromising the integrity of advertising attribution and possibly leading to financial loss or audit failures.

WordPress sites running the Pixel Tag Manager for WooCommerce plugin with versions older than 2.2.1 are affected when the plugin is available to the public. The vulnerability applies regardless of the user role, since no authentication check is performed during the AJAX request.

The EPSS score is listed as less than 1 %, indicating a very low probability of exploitation at the time of analysis, and the vulnerability is not listed in CISA’s KEV catalog. The absence of access control allows remote unauthenticated submissions, with a CVSS score of 6.5 reflecting moderate severity. The attack vector is inferred to be web‑based via an AJAX call, which can be triggered from any browser or script that can reach the plugin’s endpoint on an unprotected WordPress installation.