Pixel Manager for WooCommerce – Conversion Tracking, Google Ads, GA4, TikTok, Dynamic Remarketing <= 1.70.0 - Unauthenticated Full Path Disclosure via Google Tag Gateway Proxy Configuration File
- ID
- WPSEC-2026-1368
- Plugin
- Pixel Manager for WooCommerce – Conversion Tracking, Google Ads, GA4, TikTok, Dynamic Remarketing (woocommerce-google-adwords-conversion-tracking-tag)
- Affected
- from 1.53.0 before 1.71.0
- Remediation
- Update to 1.71.0 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
- Weakness
- CWE-200
- Usage
- Plugin Medium · Affected versions Medium among sites WPSec scans, 2026-10-21
- Attack surface
- Pixel Manager for WooCommerce – Conversion Tracking, Google Ads, GA4, TikTok, Dynamic Remarketing on WPSec AttackSurface
- Fix released
- Published
Description
The Pixel Manager for WooCommerce – Conversion Tracking, Google Ads, GA4, TikTok, Dynamic Remarketing plugin for WordPress is vulnerable to Full Path Disclosure via the Google Tag Gateway proxy configuration file in all versions up to, and including, 1.70.0, due to the file being written to a predictable location (uploads/pmw-gtg/config-<blog_id>.json, with a copy in the plugin directory) with the absolute log directory and WP_CONTENT_DIR paths in it, guarded only by an .htaccess rule that nginx ignores. This makes it possible for unauthenticated attackers to retrieve the full server path of the installation on nginx-based sites that use the Google Tag Gateway, which can help with other attacks.
References
- https://wpsec.com/vuln/WPSEC-2026-1368/
- https://plugins.svn.wordpress.org/woocommerce-google-adwords-conversion-tracking-tag/tags/1.71.0/
- https://wordpress.org/plugins/woocommerce-google-adwords-conversion-tracking-tag/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS