Technical impact
The payload identifies a flaw where an unauthenticated user can retrieve sensitive WooCommerce purchase data through the PixelYourSite plugin. By supplying an arbitrary or malformed order key, an attacker can trigger the getWooPurchaseEventParams function, which then resolves the order solely from the URL path variable. The plugin then outputs the full woocommerce purchase tracking payload, including product names, IDs, quantities, per‑item prices, order totals, currency, and transaction IDs, into the page’s JavaScript object. This constitutes a direct CWE‑200 Sensitive Information Exposure, allowing an attacker to view private order details without authentication.
Affected Systems
The vulnerability affects all PixelYourSite Pro and PixelYourSite WordPress plugins up to and including version 11.2.1. Any WordPress site using these plugin versions without an upgrade is at risk. No specific operating system or platform restrictions are indicated beyond the WordPress and WooCommerce context.
Risk and Exploitability
The CVSS score of 5.3 reflects moderate severity, and the EPSS score of <1% suggests a low probability of exploitation in the wild. Because the flaw is unauthenticated, an attacker only needs to know an existing order ID and can craft a request pipeline to trigger the exploitable endpoint; no further access or privileges are required. The vulnerability is not listed in CISA KEV, indicating that no known exploit has been publicly observed yet.
