CVE-2026-18059: PixelYourSite Information Disclosure Flaw

CVE-2026-18059 Overview

CVE-2026-18059 is a sensitive information exposure vulnerability affecting the PixelYourSite – Your smart PIXEL (TAG) & API Manager plugin for WordPress. The flaw exists in all versions up to and including 11.2.1 and is exploitable by unauthenticated attackers over the network. The plugin resolves WooCommerce orders from a URL path variable without validating the associated order key. As a result, attackers can extract purchase metadata for any known or enumerable order ID by supplying an arbitrary key. Exposed data includes product names, product IDs, quantities, per-item prices, order totals, currency, and order or transaction IDs. The information is emitted into page HTML through the pysOptions JavaScript object across Facebook, Google Analytics, and Google Tag Manager integrations.

Critical Impact
Unauthenticated attackers can harvest WooCommerce purchase metadata for any enumerable order ID, enabling large-scale data collection against affected e-commerce sites.

Affected Products

PixelYourSite – Your smart PIXEL (TAG) & API Manager plugin for WordPress, versions ≤ 11.2.1
WooCommerce stores using the affected plugin with Facebook Pixel integration
WooCommerce stores using the affected plugin with Google Analytics or Google Tag Manager integrations

Discovery Timeline

2026-08-01 - CVE-2026-18059 published to NVD
2026-08-03 - Last updated in NVD database

Technical Details for CVE-2026-18059

Vulnerability Analysis

The vulnerability is classified as Sensitive Information Exposure [CWE-200]. It stems from insufficient authorization on the getWooPurchaseEventParams code path in the PixelYourSite plugin. The plugin generates a woo_purchase tracking payload intended for use on the post-checkout thank-you page. This payload is normally scoped by an order key that acts as a shared secret between the customer and the store.

However, the plugin resolves the target order using only the order ID extracted from the URL path. The order key parameter is accepted but never validated against the stored key. The tracking payload is then serialized into the pysOptions JavaScript object and rendered directly into the page HTML for the Facebook, Google Analytics, and Google Tag Manager modules.

Root Cause

The root cause is a missing authorization check on WooCommerce order retrieval. The plugin trusts the order ID from the URL path variable and does not enforce that the supplied order key matches the value stored on the order. Because order IDs are sequential integers in WooCommerce, they are easily enumerated. The tracking payload is emitted regardless of key validity.

Attack Vector

An unauthenticated remote attacker crafts a request to the WooCommerce order-received endpoint using a valid or enumerated order ID with an arbitrary order key. The server responds with an HTML page that embeds the full woo_purchase payload in the pysOptions object. The attacker parses the response to extract product identifiers, quantities, unit prices, order totals, currency, and transaction identifiers. Iterating across the order ID space allows bulk harvesting of purchase records. Relevant source locations are documented in the WordPress Plugin Functions Source and the Wordfence Vulnerability Analysis.

Detection Methods for CVE-2026-18059

Indicators of Compromise

Repeated HTTP GET requests to /checkout/order-received/<id>/ paths with sequential or varying order IDs from a single source.
Requests containing the key= query parameter with values that do not match any legitimate WooCommerce order key.
Anomalous traffic patterns targeting the WooCommerce order-received endpoint from unauthenticated clients.

Detection Strategies

Parse web server access logs for enumeration patterns against the WooCommerce order-received URL structure.
Inspect responses for the presence of the pysOptions JavaScript object containing woo_purchase payloads served to non-customer sessions.
Correlate request source IPs with user-agent and referer anomalies indicative of automated scraping.

Monitoring Recommendations

Enable rate limiting and Web Application Firewall (WAF) rules on the WooCommerce order-received endpoint.
Alert on high-volume access to sequential order IDs from a single IP or ASN within a short window.
Log and retain full request URLs, including query strings, to support post-incident analysis of order key values.

How to Mitigate CVE-2026-18059

Immediate Actions Required

Update the PixelYourSite plugin to a version later than 11.2.1 that includes the fix referenced in the WordPress Change Set Revision.
Audit web server logs for prior enumeration attempts against the order-received endpoint.
Notify affected customers if exposure of purchase data is confirmed.

Patch Information

The vendor has released a fixed version following release tag 11.2.1. Administrators should upgrade through the WordPress plugin management interface or by deploying the updated plugin package. Verify the patched version resolves the order using both the order ID and a validated order key before emitting the woo_purchase payload.

Workarounds

Temporarily deactivate the PixelYourSite plugin until the update is applied.
Disable the Facebook, Google Analytics, and Google Tag Manager modules within the plugin to suppress emission of the pysOptions payload.
Deploy WAF rules to block requests to the order-received endpoint that carry malformed or missing order key parameters.

bash

# Example WAF rule concept blocking anonymous access to order-received without valid key format
SecRule REQUEST_URI "@rx /checkout/order-received/[0-9]+/" \
    "id:1026180590,phase:1,deny,status:403,\
     chain,msg:'Block PixelYourSite CVE-2026-18059 enumeration'"
    SecRule &ARGS:key "@eq 0"