Vulnerability · Published Oct 23, 2026 · Assigned by GitHub_M

CVE-2026-55826Customer Order Data Exposed via Unauthenticated gtm_server_side_order_id Cookie Manipulation in GTM Server Side WordPress Plugin

High 8.7

In plain English

A high-severity information exposure in gtm-server-side-wordpress-plugin from stape-io. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 27% of all known vulnerabilities).

Severity (CVSS 4.0)8.7High

Exploit odds (30 days)0.3%top 72.8% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

The GTM Server Side plugin by stape.io implements server-side tracking on WordPress websites. From version 2.0.0 to before version 2.1.48, the WooCommerce purchase event tracking mechanism allows an unauthenticated attacker to trigger the rendering of another customer's full order data — including personally identifiable information (PII) — into the page's JavaScript dataLayer. This issue has been patched in version 2.1.48.

Affected products (as reported)

Vendor	Product	Versions
stape-io	gtm-server-side-wordpress-plugin	>= 2.0.0, < 2.1.48

Weakness: CWE-200 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

References

https://github.com/stape-io/gtm-server-side-wordpress-plugin/security/advisories/GHSA-j5j2-gr8c-8rvf x_refsource_CONFIRM
https://github.com/stape-io/gtm-server-side-wordpress-plugin/commit/702898f57772279ca63d3f800336c1803103ea41 x_refsource_MISC
https://github.com/stape-io/gtm-server-side-wordpress-plugin/commit/9ff46a050028c40fad5416f2fa35be574c823434 x_refsource_MISC
https://github.com/stape-io/gtm-server-side-wordpress-plugin/releases/tag/2.1.48 x_refsource_MISC
https://github.com/stape-io/gtm-server-side-wordpress-plugin/tree/v2.1.48 x_refsource_MISC
http://github.com/stape-io/gtm-server-side-wordpress-plugin/tree/v2.1.47 x_refsource_MISC