Title: Security and caching considerations
Last modified: September 8, 2026

---

# Security and caching considerations

 *  [Dandry](https://wordpress.org/support/users/dandry/)
 * (@dandry)
 * [2 days, 15 hours ago](https://wordpress.org/support/topic/security-and-caching-considerations/)
 * Hello, thank you for creating and maintaining this plugin.
 * I was about to use it, but performed a static code review of version 2.6.11 and
   found several issues that require attention.
    1. **Potential API credential exposure – critical**
       Public event-tracking responses
       appear to include complete outbound request information. For Meta, Pinterest,
       TikTok, and Microsoft, this may expose API access tokens. The same information
       may also be stored in the plugin’s event-log table.I am intentionally not publishing
       reproduction details. Please provide a private security contact so I can share
       the evidence safely.
    2. **Missing authorization checks – high**
       Several AJAX handlers that modify plugin
       settings validate a nonce but do not independently check an administrator capability
       such as `manage_options`.A nonce used by these handlers also appears to be loaded
       on wp-admin pages available to lower-privileged users. This may allow an authenticated
       low-privilege user to change platform, event, consent, or logging settings.
    3. **Public endpoint abuse – high**
       Public tracking and logging endpoints lack 
       sufficient rate limiting, replay protection, payload-size limits, and event-
       ID deduplication. They may be abused to:
    4. **Expired nonces in cached HTML**
       Frontend AJAX nonces are embedded directly
       in page HTML. When a caching plugin serves that HTML from full-page cache after
       the nonce has expired, tracking requests fail until the cache is purged or regenerated.
 * I would really appreciate author’s reply on the matters above.
 * Thank you

You must be [logged in](https://login.wordpress.org/?redirect_to=https%3A%2F%2Fwordpress.org%2Fsupport%2Ftopic%2Fsecurity-and-caching-considerations%2F%3Foutput_format%3Dmd&locale=en_US)
to reply to this topic.

 * ![](https://ps.w.org/unipixel/assets/icon-256x256.gif?rev=3319375)
 * [UniPixel: Meta, Pinterest, TikTok, Google & Microsoft Server-Side Tracking for WooCommerce](https://wordpress.org/plugins/unipixel/)
 * [Frequently Asked Questions](https://wordpress.org/plugins/unipixel/#faq)
 * [Support Threads](https://wordpress.org/support/plugin/unipixel/)
 * [Active Topics](https://wordpress.org/support/plugin/unipixel/active/)
 * [Unresolved Topics](https://wordpress.org/support/plugin/unipixel/unresolved/)
 * [Reviews](https://wordpress.org/support/plugin/unipixel/reviews/)

 * 0 replies
 * 1 participant
 * Last reply from: [Dandry](https://wordpress.org/support/users/dandry/)
 * Last activity: [2 days, 15 hours ago](https://wordpress.org/support/topic/security-and-caching-considerations/)
 * Status: not resolved