THREATOPS

THREAT OPS › Threat News › [NVD] CVE-2026-14315 — The Pixel Tag Manager for WooCommerce WordPress plugin before 2.2.1 does not perform an authorization check on one of its AJAX actions, allowing unauthenticated users to submit forged e-commerce conversion events to the site's configured server-side advertising conversion APIs u

[NVD] CVE-2026-14315 — The Pixel Tag Manager for WooCommerce WordPress plugin before 2.2.1 does not perform an authorization check on one of its AJAX actions, allowing unauthenticated users to submit forged e-commerce conversion events to the site's configured server-side advertising conversion APIs u

mednvdPublished 2026-08-01

CVE-2026-14315 CVSS: None Published: 2026-08-01T07:16:30.307

The Pixel Tag Manager for WooCommerce WordPress plugin before 2.2.1 does not perform an authorization check on one of its AJAX actions, allowing unauthenticated users to submit forged e-commerce conversion events to the site's configured server-side advertising conversion APIs using the site's stored credentials.

MITRE ATT&CK techniques

CredentialsT1589.001

Indicators of compromise

CVE-2026-14315cve

Original source: https://nvd.nist.gov/vuln/detail/CVE-2026-14315