CVE-2025-67564: 
WordPress vulnerability analysis and mitigation

CVE-2025-67564 is a sensitive data exposure vulnerability in the Pixel Manager for WooCommerce WordPress plugin (slug: woocommerce-google-adwords-conversion-tracking-tag), developed by alekv. The flaw allows unauthenticated remote attackers to retrieve embedded sensitive system information. All plugin versions up to and including 1.51.1 are affected. It was published on December 9, 2025, and assigned a CVSS v3.1 base score of 5.3 (Medium) (Feedly, Patchstack).

The vulnerability is classified as CWE-497: Exposure of Sensitive System Information to an Unauthorized Control Sphere. The plugin improperly exposes sensitive system or configuration data in a context accessible to unauthorized parties — a pattern associated with CAPEC-170 (Web Application Fingerprinting). Because no authentication or elevated privileges are required and the attack complexity is low, an unauthenticated network attacker can trigger the information disclosure simply by interacting with the plugin's exposed functionality. No public proof-of-concept code has been identified at this time (Feedly, Patchstack).

Successful exploitation results in unauthorized disclosure of sensitive system or configuration information embedded within the plugin, with a low confidentiality impact and no effect on integrity or availability. Exposed data could include internal configuration details, API keys, or tracking pixel credentials that an attacker could leverage for further reconnaissance or targeted attacks against the WooCommerce store. The scope is limited to the affected WordPress installation, but leaked credentials or configuration data could facilitate privilege escalation or account takeover in secondary attack chains (Feedly).

No public exploit code or active in-the-wild exploitation has been reported for CVE-2025-67564. The EPSS score is approximately 0.039%, indicating a low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been identified (Feedly).

Users should update the Pixel Manager for WooCommerce plugin to a version above 1.51.1 as soon as a patched release is available from the plugin author (alekv). In the interim, site administrators should consider deactivating the plugin if it is not critical to operations, or restricting access to sensitive WordPress endpoints via web application firewall (WAF) rules. Regularly auditing installed WordPress plugins and monitoring for unauthorized access to plugin-related endpoints is also recommended (Patchstack).

The vulnerability was included in Sucuri's December 2025 Vulnerability Patch Roundup, indicating it received standard coverage in the WordPress security community (Sucuri Blog). No notable individual researcher commentary or significant social media discussion has been identified beyond routine vulnerability aggregation.