Unauthorized Event Injection in Pixelavo WordPress Plugin
CVE-2026-13604
Currently unrated
Key Information:
Badges
👾 Exploit Exists🟡 Public PoC
What is CVE-2026-13604?
The Pixelavo WordPress plugin prior to version 1.5.4 exposes an unauthenticated AJAX action that relies solely on a publicly available nonce. This security gap permits malicious users to send unauthorized event data to the Facebook Conversions API, leveraging the administrator's access token. Consequently, attackers can inject arbitrary conversion events into the advertisement account, potentially leading to an uncontrolled increase in API usage and severe disruptions to the site's advertising efforts.
Affected Version(s)
Pixelavo 0 < 1.5.4
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.