Executive brief
Pixelavo, a WordPress plugin used to integrate Facebook marketing tools, contains a security flaw that allows unauthorized visitors to interfere with a site's Facebook Ads account. By exploiting a publicly visible security token, an attacker can send fake customer activity data to Facebook using the site owner's credentials. This can result in corrupted marketing analytics, fraudulent conversion data, and the exhaustion of the site's Facebook API usage limits.
Technical details
The Pixelavo plugin for WordPress (versions prior to 1.5.4) is vulnerable to a form of Server-Side Request Forgery (SSRF) and unauthorized data injection. The plugin registers the 'pixelavo_event' AJAX action for unauthenticated users, intended to track user interactions. However, the security nonce required to authorize this action is printed in the source code of every public page. An attacker can scrape this nonce and send arbitrary event data to the 'pixelavo_event' endpoint. The plugin then forwards this data to the Facebook Conversions API using the administrator's stored access token, allowing attackers to inject fraudulent conversion events and exhaust API quotas. The issue is fixed in version 1.5.4.
Affected products
- Unknown Pixelavo < 1.5.4
Timeline
- 2026-07-20: disclosed
- 2026-08-01: advisory: NVD publication date
- patched: Fixed in version 1.5.4