The vulnerability identified as CVE-2025-12545 affects the Pixel Manager for WooCommerce – Track Conversions and Analytics, Google Ads, TikTok and more plugin for WordPress, specifically versions up to 1.49.2. The root cause lies in the ajax_pmw_get_product_ids() function, which lacks sufficient access control checks to restrict which product IDs can be queried via AJAX requests. This flaw allows unauthenticated attackers to retrieve data from products that are intended to be protected, including password-protected, private, or draft products. Since WooCommerce is a widely used e-commerce platform on WordPress, this plugin is commonly deployed to manage tracking pixels for marketing and analytics purposes. The vulnerability is classified under CWE-200, indicating exposure of sensitive information to unauthorized actors. The CVSS v3.1 base score is 5.3, reflecting a medium severity level with network attack vector, low attack complexity, no privileges required, and no user interaction needed. The impact is limited to confidentiality, with no direct integrity or availability effects. No known exploits have been reported in the wild to date. The vulnerability was reserved on October 31, 2025, and published on November 18, 2025. No official patches or updates are currently linked, so mitigation may require temporary workarounds or monitoring for forthcoming updates from the vendor.

For European organizations, this vulnerability could lead to unauthorized disclosure of sensitive product information, including unreleased or confidential product details that could be leveraged by competitors or malicious actors. Exposure of private or draft product data may result in reputational damage, loss of customer trust, and potential financial harm if sensitive marketing or pricing strategies are revealed prematurely. Since the vulnerability does not require authentication or user interaction, any attacker with network access to the affected WordPress site could exploit it remotely. This increases the risk profile for e-commerce businesses relying on WooCommerce and this plugin. Although the vulnerability does not directly affect system integrity or availability, the confidentiality breach alone can have significant business impact, especially for companies with strict data protection requirements under GDPR. Additionally, attackers could combine this information exposure with other attacks to escalate their foothold or conduct targeted phishing campaigns.

1. Monitor the vendor’s official channels for a security patch addressing CVE-2025-12545 and apply updates immediately upon release. 2. Until a patch is available, implement custom access control on the ajax_pmw_get_product_ids() AJAX endpoint to restrict requests to authenticated and authorized users only. 3. Employ Web Application Firewalls (WAFs) to detect and block suspicious AJAX requests targeting this function, especially those originating from unauthenticated sources. 4. Review and harden WordPress and WooCommerce security configurations, including limiting plugin permissions and disabling unnecessary AJAX endpoints. 5. Conduct regular audits of product visibility settings to ensure sensitive products are properly protected. 6. Educate development and security teams about this vulnerability to increase awareness and readiness for incident response. 7. Consider isolating or segmenting e-commerce infrastructure to limit exposure in case of exploitation. 8. Implement comprehensive logging and monitoring to detect anomalous access patterns related to product data retrieval.