CVE-2026-18059 describes a sensitive information exposure vulnerability (CWE-200) in the PixelYourSite WordPress plugin up to version 11.2.1. The vulnerability arises in the getWooPurchaseEventParams function, which allows unauthenticated attackers to extract detailed WooCommerce purchase metadata by providing arbitrary or invalid order keys. The plugin resolves the order solely based on the URL path variable and outputs the full woo_purchase tracking payload into the page HTML via the pysOptions JavaScript object, affecting integrations with Facebook, Google Analytics, and Google Tag Manager. This exposure does not require authentication and leaks information for any known or enumerated order ID.

The vulnerability allows unauthenticated attackers to access sensitive WooCommerce purchase information including product names, product IDs, quantities, per-item prices, order totals, currency, and order/transaction IDs. This exposure could lead to privacy violations and information disclosure but does not impact integrity or availability. There is no indication of active exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or temporary workaround is currently documented. Users should monitor vendor communications for updates and consider restricting access to affected endpoints or disabling the plugin until a fix is available.