CVE-2026-13604: CWE-918 Server-Side Request Forgery (SSRF) in Pixelavo
The Pixelavo WordPress plugin before 1.5.4 registers an unauthenticated AJAX action, gated only by a nonce that it emits publicly on every front-end page, that forwards client-supplied event data to the configured Facebook Conversions API using the administrator's stored access token. This allows an unauthenticated visitor to inject arbitrary conversion events into the administrator's Facebook ads account and exhaust the configured API quota.
AI Analysis
Technical Summary
The Pixelavo WordPress plugin versions prior to 1.5.4 register an unauthenticated AJAX action protected only by a nonce that is publicly available on every front-end page. This action forwards client-supplied event data to the Facebook Conversions API using the administrator's stored access token. Because the nonce is publicly exposed and no authentication is required, an attacker can inject arbitrary conversion events into the administrator's Facebook ads account, leading to exhaustion of the configured API quota. This vulnerability is classified as CWE-918 (Server-Side Request Forgery).
Potential Impact
An unauthenticated attacker can inject arbitrary conversion events into the administrator's Facebook ads account, which can lead to exhaustion of the API quota configured for the Facebook Conversions API. There is no direct confidentiality or availability impact to the WordPress site itself, but the integrity of the Facebook ads data is compromised.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, consider disabling the Pixelavo plugin or restricting access to the AJAX action if possible to prevent unauthenticated event injection.
CVE-2026-13604: CWE-918 Server-Side Request Forgery (SSRF) in Pixelavo
Description
The Pixelavo WordPress plugin before 1.5.4 registers an unauthenticated AJAX action, gated only by a nonce that it emits publicly on every front-end page, that forwards client-supplied event data to the configured Facebook Conversions API using the administrator's stored access token. This allows an unauthenticated visitor to inject arbitrary conversion events into the administrator's Facebook ads account and exhaust the configured API quota.
CVSS v3.1
Score 5.3medium
Affected software
Pixelavo
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The Pixelavo WordPress plugin versions prior to 1.5.4 register an unauthenticated AJAX action protected only by a nonce that is publicly available on every front-end page. This action forwards client-supplied event data to the Facebook Conversions API using the administrator's stored access token. Because the nonce is publicly exposed and no authentication is required, an attacker can inject arbitrary conversion events into the administrator's Facebook ads account, leading to exhaustion of the configured API quota. This vulnerability is classified as CWE-918 (Server-Side Request Forgery).
Potential Impact
An unauthenticated attacker can inject arbitrary conversion events into the administrator's Facebook ads account, which can lead to exhaustion of the API quota configured for the Facebook Conversions API. There is no direct confidentiality or availability impact to the WordPress site itself, but the integrity of the Facebook ads data is compromised.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, consider disabling the Pixelavo plugin or restricting access to the AJAX action if possible to prevent unauthenticated event injection.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- WPScan
- Date Reserved
- 2026-06-29T08:27:24.366Z
- State
- PUBLISHED
Threat ID: 6a6d96cfbf32cb7a344cecd8
Added to database: 08/01/2026, 06:48:47 UTC
Last enriched: 08/08/2026, 13:51:35 UTC
Last updated: 09/16/2026, 22:01:32 UTC
Views: 35
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.