CVE-2025-12545: WordPress Plugin Information Disclosure

CVE-2025-12545 Overview

CVE-2025-12545 affects the Pixel Manager for WooCommerce WordPress plugin, which tracks conversions and analytics for Google Ads, TikTok, and other advertising platforms. The vulnerability exists in all versions up to and including 1.49.2. The flaw resides in the ajax_pmw_get_product_ids() function, which fails to restrict which products can be included in responses. Unauthenticated attackers can extract data from password-protected, private, or draft products through this endpoint. The vulnerability is classified as Information Exposure [CWE-200].

Critical Impact
Unauthenticated remote attackers can extract product data from password-protected, private, and draft WooCommerce products through an exposed AJAX endpoint.

Affected Products

Pixel Manager for WooCommerce plugin versions up to and including 1.49.2
WordPress sites running WooCommerce with the affected plugin
Sites relying on private, draft, or password-protected products for confidentiality

Discovery Timeline

2025-11-18 - CVE-2025-12545 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-12545

Vulnerability Analysis

The Pixel Manager plugin exposes an AJAX action handled by ajax_pmw_get_product_ids() located in includes/pixels/class-pixel-manager.php. This function returns product identifiers and associated data to any client that invokes it. The handler does not verify the visibility state of the products it enumerates. As a result, products marked as private, draft, or password-protected are included in the response alongside publicly published products.

An attacker does not need authentication or user interaction to trigger the endpoint. The endpoint is reachable over the network via the standard WordPress admin-ajax.php interface. The information returned may include product identifiers, names, prices, and other metadata that store owners intentionally restricted from public view.

Root Cause

The root cause is insufficient access control on product visibility filtering. The plugin queries the WooCommerce product catalog without applying visibility or status filters that respect WordPress post visibility settings. Product status checks that would normally exclude non-public items are absent from the AJAX response path.

Attack Vector

Exploitation requires sending an unauthenticated HTTP request to the WordPress AJAX endpoint with the plugin's registered action name. The server responds with product identifiers that include hidden entries. Attackers can then request additional product details or scrape unreleased inventory, pricing changes, or confidential product configurations. No exploitation code is required beyond a standard HTTP client. See the Wordfence Vulnerability Analysis for further technical details.

Detection Methods for CVE-2025-12545

Indicators of Compromise

Unauthenticated requests to admin-ajax.php invoking the pmw_get_product_ids action from a single IP at high volume
Access log entries showing repeated AJAX calls without authenticated session cookies
Enumeration patterns iterating through product IDs shortly after AJAX calls

Detection Strategies

Review web server logs for requests to /wp-admin/admin-ajax.php containing the Pixel Manager action parameter
Correlate anonymous AJAX activity with subsequent requests targeting private or draft product URLs
Alert on unusual response sizes from the plugin endpoint that suggest bulk product data extraction

Monitoring Recommendations

Enable request logging on WordPress sites running WooCommerce and forward logs to a centralized analytics platform
Deploy a Web Application Firewall (WAF) rule to flag unauthenticated calls to plugin-specific AJAX actions
Monitor outbound traffic patterns from the web server that may indicate scraping or reconnaissance activity

How to Mitigate CVE-2025-12545

Immediate Actions Required

Update the Pixel Manager for WooCommerce plugin to a version later than 1.49.2 as soon as the vendor releases a fixed build
Audit product visibility settings and rotate any leaked pricing, SKU, or draft configuration data
Restrict access to admin-ajax.php at the WAF layer for known plugin actions when not required for site functionality

Patch Information

The vendor has been notified through the WordPress plugin repository disclosure process. Site administrators should monitor the WordPress Plugin Code Reference for updated tags beyond 1.49.2 and apply the patched version once available. Review the Wordfence Vulnerability Analysis for the latest remediation guidance.

Workarounds

Temporarily deactivate the Pixel Manager for WooCommerce plugin until a patched version is installed
Block unauthenticated POST requests to the pmw_get_product_ids AJAX action at the WAF or reverse proxy
Remove sensitive metadata from draft and private products while awaiting a vendor fix

bash

# Example WAF rule to block the vulnerable AJAX action
# ModSecurity rule blocking unauthenticated requests to the endpoint
SecRule REQUEST_URI "@contains /wp-admin/admin-ajax.php" \
  "chain,phase:2,deny,status:403,id:1012545,\
   msg:'Block CVE-2025-12545 Pixel Manager AJAX abuse'"
SecRule ARGS:action "@streq pmw_get_product_ids" \
  "chain"
SecRule &REQUEST_COOKIES:/wordpress_logged_in_/ "@eq 0"