Privilege Escalation in Pixel Tag Manager for WooCommerce Plugin by WordPress
CVE-2026-105199
Key Information:
- Vendor
WordPress
- Vendor
- CVE Published:
- 24 October 2026
Badges
What is CVE-2026-105199?
The Pixel Tag Manager for WooCommerce WordPress plugin versions prior to 2.2.3 contain a vulnerability that lacks adequate capability checks in one of its AJAX actions. This oversight allows harmful interactions by users with low-level roles, such as Contributors, who can exploit the weakness to overwrite settings within the plugin. Additionally, it exposes the nonce meant for protection to any authenticated user accessing the admin dashboard, which can lead to the execution of arbitrary JavaScript in the browsers of all visitors, including those with administrative privileges.
Affected Version(s)
Pixel Tag Manager for WooCommerce 0 < 2.2.3
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.