What’s Vulnerable › Vulnerabilities

CVE-2024-7870: PixelYourSite – Your smart PIXEL (TAG) & API Manager <= 9.7.1 and PixelYourSite PRO <= 10.4.2 - Unauthenticated Information Exposure and Log Deletion

• Severity: high (CVSS 7.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.4% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2024-09-04 · updated 2026-06-17
• Weakness: CWE-287

Description

The PixelYourSite – Your smart PIXEL (TAG) & API Manager and the PixelYourSite PRO plugins for WordPress are vulnerable to Sensitive Information Exposure in all versions up to, and including, 9.7.1 and 10.4.2, respectively, through publicly exposed log files. This makes it possible for unauthenticated attackers to view potentially sensitive information contained in the exposed log files, and to delete log files.

Affected products

• PixelYourSite – Your smart PIXEL (TAG) Manager: before 9.7.2; before 10.4.3 — fixed in 10.4.3, 9.7.2

How to fix

Upgrade to a fixed version: PixelYourSite – Your smart PIXEL (TAG) Manager 10.4.3, 9.7.2. Check the vendor advisory for mitigations.

References

• https://github.com/WordpressPluginDirectory/pixelyoursite/blob/main/pixelyoursite/includes/logger/class-pys-logger.php#L126
• https://plugins.trac.wordpress.org/browser/pixelyoursite/trunk/includes/class-pys.php#L114
• https://plugins.trac.wordpress.org/changeset/3143047/
• https://www.wordfence.com/threat-intel/vulnerabilities/id/7fd7a515-6389-4152-8dac-d5497dd94f6d?source=cve

Get alerted when CVE-2024-7870 or the next vulnerability affects your stack