CVE-2026-55826
HIGH
8,7
Source: [email protected]
Attack Vector: network
Attack Complexity: low
Privileges Required: none
User Interaction: none
Confidentiality: N/A
Integrity: N/A
Availability: N/A
Description
The GTM Server Side plugin by stape.io implements server-side tracking on WordPress websites. From version 2.0.0 to before version 2.1.48, the WooCommerce purchase event tracking mechanism allows an unauthenticated attacker to trigger the rendering of another customer's full order data — including personally identifiable information (PII) — into the page's JavaScript dataLayer. This issue has been patched in version 2.1.48.
200
Exposure of Sensitive Information to an Unauthorized Actor
DraftCommon Consequences
Security Scopes Affected:
Confidentiality
Potential Impacts:
Read Application Data
Applicable Platforms
Technologies:
Not Technology-Specific, Web Based, Mobile
http://github.com/stape-io/gtm-server-side-wordpress-plugin/tree/v2.1.47
https://github.com/stape-io/gtm-server-side-wordpress-plugin/commit/702898f5777…
https://github.com/stape-io/gtm-server-side-wordpress-plugin/commit/9ff46a05002…
https://github.com/stape-io/gtm-server-side-wordpress-plugin/releases/tag/2.1.48
https://github.com/stape-io/gtm-server-side-wordpress-plugin/security/advisorie…
https://github.com/stape-io/gtm-server-side-wordpress-plugin/tree/v2.1.48