CVE-2026-13604 Overview
CVE-2026-13604 affects the Pixelavo WordPress plugin in versions before 1.5.4. The plugin registers an unauthenticated AJAX action protected only by a nonce that the plugin emits publicly on every front-end page. The endpoint forwards client-supplied event data to the configured Facebook Conversions API using the administrator's stored access token. An unauthenticated visitor can inject arbitrary conversion events into the administrator's Facebook ads account and exhaust the configured API quota. The issue is classified under [CWE-918] Server-Side Request Forgery.
Critical Impact
Unauthenticated attackers can poison conversion analytics and exhaust Facebook Conversions API quotas by abusing the plugin's public nonce and stored administrator access token.
Affected Products
- Pixelavo WordPress plugin versions prior to 1.5.4
- WordPress sites configured with a Facebook Conversions API access token
- Administrator-linked Facebook Ads accounts using the plugin
Discovery Timeline
- 2026-08-01 - CVE-2026-13604 published to NVD
- 2026-08-05 - Last updated in NVD database
Technical Details for CVE-2026-13604
Vulnerability Analysis
The Pixelavo plugin exposes an AJAX endpoint intended to relay client-side events to the Facebook Conversions API. The endpoint accepts requests without authentication. The only gate is a WordPress nonce, which the plugin embeds in the HTML delivered to every unauthenticated front-end visitor. An attacker fetches any page, extracts the nonce, and replays it to the endpoint with arbitrary event payloads.
Each forwarded request uses the administrator's stored access token to authenticate against Facebook's servers. The plugin acts as a confused deputy, converting anonymous public input into authenticated outbound calls under a privileged identity. This aligns with the [CWE-918] Server-Side Request Forgery classification, where the server issues attacker-controlled requests using trusted credentials.
Root Cause
The root cause is a design flaw in access control. The plugin treats the nonce as a security boundary, but the nonce is not a secret when it is rendered on public pages. No capability check, origin validation, rate limiting, or event integrity verification is applied before the plugin proxies the payload to Facebook.
Attack Vector
An unauthenticated remote attacker retrieves the front-end nonce, then submits crafted POST requests to the plugin's AJAX action. Each request causes the WordPress host to invoke the Facebook Conversions API with attacker-controlled event fields such as event name, user data, and custom properties. The attacker can flood the endpoint to burn the daily API quota or seed the ads account with fabricated conversion signals that corrupt attribution and campaign optimization.
No verified public proof-of-concept code is available. See the WPScan Vulnerability Report for technical details.
Detection Methods for CVE-2026-13604
Indicators of Compromise
- Elevated volumes of POST requests to admin-ajax.php referencing the Pixelavo plugin action name
- Unexpected spikes in Facebook Conversions API events with implausible timestamps, geographies, or event types
- Facebook Ads Manager reporting quota exhaustion or degraded event match quality
- Requests to admin-ajax.php from IP ranges not associated with legitimate site traffic
Detection Strategies
- Correlate WordPress access logs with Facebook Events Manager diagnostics to identify mismatches between site sessions and reported conversions
- Alert on repeated same-nonce reuse from a single client against Pixelavo AJAX actions
- Monitor egress from the WordPress host to graph.facebook.com for abnormal request rates
Monitoring Recommendations
- Enable request logging on wp-admin/admin-ajax.php and retain logs for correlation
- Track Facebook Conversions API quota consumption and event volumes daily
- Flag conversion events whose event_source_url does not match legitimate site paths
How to Mitigate CVE-2026-13604
Immediate Actions Required
- Update the Pixelavo plugin to version 1.5.4 or later on all WordPress instances
- Rotate the Facebook Conversions API access token stored in the plugin configuration
- Review recent Facebook Ads conversion data for injected or anomalous events and exclude affected windows from campaign optimization
- Restrict access to admin-ajax.php behind a web application firewall rule that rate-limits unauthenticated event submissions
Patch Information
The vendor addressed the issue in Pixelavo version 1.5.4. Refer to the WPScan Vulnerability Report for advisory details and remediation guidance.
Workarounds
- Deactivate the Pixelavo plugin until the patched version is deployed
- Remove or invalidate the Facebook Conversions API access token if the plugin cannot be updated immediately
- Deploy WAF rules to block unauthenticated POST requests targeting the Pixelavo AJAX action
- Apply per-IP rate limiting on admin-ajax.php to constrain quota abuse attempts
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
