The Pixel Manager for WooCommerce – Conversion Tracking, Google Ads, GA4, TikTok, Dynamic Remarketing plugin for WordPress contains an information exposure vulnerability (CWE-200) in the ajax_pmw_get_product_ids() function. This function does not properly restrict access to product data, enabling unauthenticated attackers to extract information from products that are password protected, private, or in draft status. The vulnerability affects all versions up to 1.49.2. The CVSS 3.1 score is 5.3 (medium severity), with an attack vector of network, no privileges required, and no user interaction needed. No patch or official fix is currently documented.

An unauthenticated attacker can access sensitive product information that should be restricted, including data from password protected, private, or draft products. This exposure could lead to leakage of confidential business information or product details. There is no indication of impact on integrity or availability, only confidentiality is affected. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should consider restricting access to the affected plugin or disabling it if possible. Monitor official vendor channels for updates and apply any released patches promptly.