{
 "id": "WPSEC-2026-1368",
 "url": "https://wpsec.com/vuln/WPSEC-2026-1368/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-1368/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-1368/index.md",
 "title": "Pixel Manager for WooCommerce – Conversion Tracking, Google Ads, GA4, TikTok, Dynamic Remarketing <= 1.70.0 - Unauthenticated Full Path Disclosure via Google Tag Gateway Proxy Configuration File",
 "description": "The Pixel Manager for WooCommerce – Conversion Tracking, Google Ads, GA4, TikTok, Dynamic Remarketing plugin for WordPress is vulnerable to Full Path Disclosure via the Google Tag Gateway proxy configuration file in all versions up to, and including, 1.70.0, due to the file being written to a predictable location (uploads/pmw-gtg/config-<blog_id>.json, with a copy in the plugin directory) with the absolute log directory and WP_CONTENT_DIR paths in it, guarded only by an .htaccess rule that nginx ignores. This makes it possible for unauthenticated attackers to retrieve the full server path of the installation on nginx-based sites that use the Google Tag Gateway, which can help with other attacks.",
 "plugin": {
  "slug": "woocommerce-google-adwords-conversion-tracking-tag",
  "name": "Pixel Manager for WooCommerce – Conversion Tracking, Google Ads, GA4, TikTok, Dynamic Remarketing",
  "full_name": "Pixel Manager for WooCommerce – Conversion Tracking, Google Ads, GA4, TikTok, Dynamic Remarketing",
  "wordpress_org": "https://wordpress.org/plugins/woocommerce-google-adwords-conversion-tracking-tag/",
  "advisories_url": "https://wpsec.com/vuln/plugin/woocommerce-google-adwords-conversion-tracking-tag/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/woocommerce-google-adwords-conversion-tracking-tag"
 },
 "type": "SENSITIVE DATA DISCLOSURE",
 "cwe": [
  "CWE-200"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 3.7,
  "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N",
  "severity": "Low"
 },
 "affected": {
  "ranges": [
   {
    "from": "1.53.0",
    "from_inclusive": true,
    "to": "1.71.0",
    "to_inclusive": false
   }
  ],
  "text": [
   "from 1.53.0 before 1.71.0"
  ]
 },
 "introduced_in": "1.53.0",
 "fixed_in": "1.71.0",
 "remediation": "Update to 1.71.0 or later.",
 "fix_released": "2026-10-20T13:16:42+00:00",
 "published": "2026-10-21T13:44:54+00:00",
 "updated": "2026-10-21T11:59:28.892154+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-1368/",
  "https://plugins.svn.wordpress.org/woocommerce-google-adwords-conversion-tracking-tag/tags/1.71.0/",
  "https://wordpress.org/plugins/woocommerce-google-adwords-conversion-tracking-tag/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/woocommerce-google-adwords-conversion-tracking-tag",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Medium",
  "affected_versions": "Medium",
  "as_of": "2026-10-21"
 }
}