CVE-2025-12545

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-12545", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2025-10-31T11:20:54.685Z", "datePublished": "2025-11-18T13:54:50.617Z", "dateUpdated": "2026-04-08T17:11:17.622Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:11:17.622Z"}, "affected": [{"vendor": "alekv", "product": "Pixel Manager for WooCommerce \u2013 Conversion Tracking, Google Ads, GA4, TikTok, Dynamic Remarketing", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "1.49.2", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The Pixel Manager for WooCommerce \u2013 Track Conversions and Analytics, Google Ads, TikTok and more plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 1.49.2 via the ajax_pmw_get_product_ids() function due to insufficient restrictions on which products can be included. This makes it possible for unauthenticated attackers to extract data from password protected, private, or draft products that they should not have access to."}], "title": "Pixel Manager for WooCommerce \u2013 Track Conversions and Analytics, Google Ads, TikTok and more <= 1.49.2 - Unauthenticated Information Exposure", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/9babb946-4033-4e66-8f59-b73185ffcd49?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/woocommerce-google-adwords-conversion-tracking-tag/tags/1.49.2/includes/pixels/class-pixel-manager.php#L343"}, {"url": "https://plugins.trac.wordpress.org/browser/woocommerce-google-adwords-conversion-tracking-tag/tags/1.49.2/includes/pixels/class-pixel-manager.php#L1235"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-200 Exposure of Sensitive Information to an Unauthorized Actor", "cweId": "CWE-200", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "baseScore": 5.3, "baseSeverity": "MEDIUM"}}], "credits": [{"lang": "en", "type": "finder", "value": "Athiwat Tiprasaharn"}], "timeline": [{"time": "2025-10-24T00:00:00.000Z", "lang": "en", "value": "Discovered"}, {"time": "2025-10-31T11:36:31.000Z", "lang": "en", "value": "Vendor Notified"}, {"time": "2025-11-18T01:18:04.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-11-18T14:25:36.833401Z", "id": "CVE-2025-12545", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-11-18T14:27:27.545Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-12545", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-11-18T14:25:36.833401Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-11-18T14:27:23.647Z"}}], "cna": {"title": "Pixel Manager for WooCommerce \u2013 Track Conversions and Analytics, Google Ads, TikTok and more <= 1.49.2 - Unauthenticated Information Exposure", "credits": [{"lang": "en", "type": "finder", "value": "Athiwat Tiprasaharn"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 5.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"}}], "affected": [{"vendor": "alekv", "product": "Pixel Manager for WooCommerce \u2013 Conversion Tracking, Google Ads, GA4, TikTok, Dynamic Remarketing", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "1.49.2"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2025-10-24T00:00:00.000Z", "value": "Discovered"}, {"lang": "en", "time": "2025-10-31T11:36:31.000Z", "value": "Vendor Notified"}, {"lang": "en", "time": "2025-11-18T01:18:04.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/9babb946-4033-4e66-8f59-b73185ffcd49?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/woocommerce-google-adwords-conversion-tracking-tag/tags/1.49.2/includes/pixels/class-pixel-manager.php#L343"}, {"url": "https://plugins.trac.wordpress.org/browser/woocommerce-google-adwords-conversion-tracking-tag/tags/1.49.2/includes/pixels/class-pixel-manager.php#L1235"}], "descriptions": [{"lang": "en", "value": "The Pixel Manager for WooCommerce \u2013 Track Conversions and Analytics, Google Ads, TikTok and more plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 1.49.2 via the ajax_pmw_get_product_ids() function due to insufficient restrictions on which products can be included. This makes it possible for unauthenticated attackers to extract data from password protected, private, or draft products that they should not have access to."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-200", "description": "CWE-200 Exposure of Sensitive Information to an Unauthorized Actor"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:11:17.622Z"}}}, "cveMetadata": {"cveId": "CVE-2025-12545", "state": "PUBLISHED", "dateUpdated": "2026-04-08T17:11:17.622Z", "dateReserved": "2025-10-31T11:20:54.685Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2025-11-18T13:54:50.617Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Pixel Manager for WooCommerce \u2013 Conversion Tracking, Google Ads, GA4, TikTok, Dynamic Remarketing", "vendor": "alekv", "versions": [{"lessThanOrEqual": "1.49.2", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The Pixel Manager for WooCommerce \u2013 Track Conversions and Analytics, Google Ads, TikTok and more plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 1.49.2 via the ajax_pmw_get_product_ids() function due to insufficient restrictions on which products can be included. This makes it possible for unauthenticated attackers to extract data from password protected, private, or draft products that they should not have access to."}, {"lang": "es", "value": "El plugin Pixel Manager for WooCommerce - Track Conversions and Analytics, Google Ads, TikTok and more para WordPress es vulnerable a la Exposici\u00f3n de Informaci\u00f3n en todas las versiones hasta la 1.49.2, inclusive, a trav\u00e9s de la funci\u00f3n ajax_pmw_get_product_ids() debido a restricciones insuficientes sobre qu\u00e9 productos pueden ser incluidos. Esto hace posible que atacantes no autenticados extraigan datos de productos protegidos con contrase\u00f1a, privados o en borrador a los que no deber\u00edan tener acceso."}], "id": "CVE-2025-12545", "lastModified": "2026-10-18T20:10:00.110", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 1.4, "source": "security@wordfence.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-12545", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2025-11-18T14:25:36.833401Z", "version": "2.0.3"}}]}, "published": "2025-11-18T15:16:26.483", "references": [{"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/woocommerce-google-adwords-conversion-tracking-tag/tags/1.49.2/includes/pixels/class-pixel-manager.php#L1235"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/woocommerce-google-adwords-conversion-tracking-tag/tags/1.49.2/includes/pixels/class-pixel-manager.php#L343"}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/9babb946-4033-4e66-8f59-b73185ffcd49?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-200"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-21T18:13:12.483272+00:00", "value": {"mitigation_remediation": ["Update Pixel Manager for WooCommerce to a version newer than 1.49.2 so that the ajax_pmw_get_product_ids() function properly restricts product visibility.", "Ensure WordPress user roles and permissions are configured so that anonymous or unauthenticated users cannot access private or draft content, thereby reducing the impact of the exposed endpoint.", "Apply or configure a security plugin or firewall rule that authenticates or blocks unauthenticated requests to the ajax_pmw_get_product_ids endpoint, adding an extra layer of access control to mitigate the information exposure."], "summary": {"action": "Patch Plugin", "impact": "Unauthorized Information Exposure"}, "threat_synthesis": {"affected_systems": "All installations of Pixel Manager for WooCommerce \u2013 Conversion Tracking, Google Ads, GA4, TikTok, Dynamic Remarketing with versions up to and including 1.49.2 on WordPress sites are affected. No further version specifications are available; therefore any instance using 1.49.2 or older is vulnerable.", "description_and_impact": "The vulnerability resides in the ajax_pmw_get_product_ids() function of the Pixel Manager for WooCommerce plugin. It allows an attacker lacking authentication to retrieve product identifiers for items that are password protected, private, or marked as draft. This leads to unintended disclosure of potentially sensitive product data, violating confidentiality. The weakness is classified as CWE-200, indicating an information exposure flaw.", "risk_and_exploitability": "The CVSS score of 5.3 indicates moderate severity, while the EPSS score of <1% suggests a low likelihood of exploitation in the wild. The plugin is not listed in CISA KEV, meaning the vulnerability has not yet been reported as actively exploited. The attack vector is unauthenticated, and an attacker can trigger the exposed AJAX endpoint to gather sensitive product information without needing any credentials."}}}}, "created": "2025-11-21T09:16:16.986564+00:00", "updated": "2026-04-21T18:15:36.378921+00:00", "vendors": ["alekv", "alekv$PRODUCT$pixel_manager_for_woocommerce", "woocommerce", "woocommerce$PRODUCT$woocommerce", "wordpress", "wordpress$PRODUCT$wordpress"]}