CVE-2026-13604

Name of the Vulnerable Software and Affected Versions Pixelavo versions prior to 1.5.4

Description The plugin registers an unauthenticated AJAX action that forwards client-supplied event data to the Facebook Conversions API using the administrator's stored access token. This action is protected only by a nonce (a number used once to prevent replay attacks) that is publicly emitted on every front-end page. Consequently, an unauthenticated visitor can inject arbitrary conversion events into the administrator's Facebook ads account, potentially exhausting the configured API quota. The affected endpoint is pixelavo event.

Recommendations Update Pixelavo to version 1.5.4 or later.