CVE-2026-55826
Customer Order Data Exposed via Unauthenticated gtm_server_side_order_id Cookie Manipulation in GTM Server Side WordPress Plugin
CVSS Score
0.0
EPSS Score
0.0%
EPSS Percentile
0th
The GTM Server Side plugin by stape.io implements server-side tracking on WordPress websites. From version 2.0.0 to before version 2.1.48, the WooCommerce purchase event tracking mechanism allows an unauthenticated attacker to trigger the rendering of another customer's full order data — including personally identifiable information (PII) — into the page's JavaScript dataLayer. This issue has been patched in version 2.1.48.
| CWE | CWE-200 |
| Vendor | stape-io |
| Product | gtm-server-side-wordpress-plugin |
| Published | Oct 23, 2026 |
Stay Ahead of the Next One
Get instant alerts for stape-io gtm-server-side-wordpress-plugin
Be the first to know when new unknown vulnerabilities affecting stape-io gtm-server-side-wordpress-plugin are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
Affected Versions
stape-io / gtm-server-side-wordpress-plugin
>= 2.0.0, < 2.1.48
References
github.com: https://github.com/stape-io/gtm-server-side-wordpress-plugin/security/advisories/GHSA-j5j2-gr8c-8rvf github.com: https://github.com/stape-io/gtm-server-side-wordpress-plugin/commit/702898f57772279ca63d3f800336c1803103ea41 github.com: https://github.com/stape-io/gtm-server-side-wordpress-plugin/commit/9ff46a050028c40fad5416f2fa35be574c823434 github.com: https://github.com/stape-io/gtm-server-side-wordpress-plugin/releases/tag/2.1.48 github.com: https://github.com/stape-io/gtm-server-side-wordpress-plugin/tree/v2.1.48 github.com: http://github.com/stape-io/gtm-server-side-wordpress-plugin/tree/v2.1.47