CVE-2025-12545 Information disclosure in Pixel Manager for WooCommerce – Conversion Tracking, Google Ads, GA4, TikTok, Dynamic Remarketing
Unauthenticated attackers can extract data from password protected, private, or draft products via an AJAX function in the Pixel Manager for WooCommerce plugin.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2025-12545?
CVE-2025-12545 is a medium-severity vulnerability in alekv Pixel Manager for WooCommerce – Conversion Tracking, Google Ads, GA4, TikTok, Dynamic Remarketing, published on 18 Nov 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The Pixel Manager for WooCommerce – Track Conversions and Analytics, Google Ads, TikTok and more plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 1.49.2 via the ajax_pmw_get_product_ids() function due to insufficient restrictions on which products can be included. This makes it possible for unauthenticated attackers to extract data from password protected, private, or draft products that they should not have access to.
Weakness: CWE-200
Which versions are affected by CVE-2025-12545?
How do I fix CVE-2025-12545?
No fix has been published for CVE-2025-12545 yet. Limit exposure of the affected software until one is available.
Is CVE-2025-12545 being exploited?
There is no known exploitation of CVE-2025-12545 in the wild and no public exploit code.
Sources
Also known as GHSA-hqmj-vh3f-w9cw.