CVE-2026-14315CWE-284broken-access-control

CVE-2026-14315

Medium · published August 1, 2026

CVSS v3.1

6.5

EPSS

Percentile

18.9

In the wild

Unconfirmed

What it is

The Pixel Tag Manager for WooCommerce WordPress plugin before 2.2.1 does not perform an authorization check on one of its AJAX actions, allowing unauthenticated users to submit forged e-commerce conversion events to the site's configured server-side advertising conversion APIs using the site's stored credentials.

The record

Technical detail

CVSS v3.1: 6.5 · MEDIUM
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
CVSS v4.0: Not supplied
EPSS: 0.00275 · 18.9th percentile
Weakness: CWE-284 · Improper Access Control
Published: 2026-08-01T11:16Z

References (1)

https://wpscan.com/vulnerability/0d7c113a-b677-4687-a077-ec0ec7deff83/ · [email protected]

EPSS history

Timeline

01 AUG 06:00Z
Pixel Tag Manager for WooCommerce < 2.2.1 - Unauthenticated Forged Conversion Event Submission
cvelistv5