CVE-2026-55826

high

Description

The GTM Server Side plugin by stape.io implements server-side tracking on WordPress websites. From version 2.0.0 to before version 2.1.48, the WooCommerce purchase event tracking mechanism allows an unauthenticated attacker to trigger the rendering of another customer's full order data — including personally identifiable information (PII) — into the page's JavaScript dataLayer. This issue has been patched in version 2.1.48.

References

https://github.com/stape-io/gtm-server-side-wordpress-plugin/tree/v2.1.48

https://github.com/stape-io/gtm-server-side-wordpress-plugin/security/advisories/GHSA-j5j2-gr8c-8rvf

https://github.com/stape-io/gtm-server-side-wordpress-plugin/releases/tag/2.1.48

https://github.com/stape-io/gtm-server-side-wordpress-plugin/commit/9ff46a050028c40fad5416f2fa35be574c823434

https://github.com/stape-io/gtm-server-side-wordpress-plugin/commit/702898f57772279ca63d3f800336c1803103ea41

https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-108976

http://github.com/stape-io/gtm-server-side-wordpress-plugin/tree/v2.1.47

Details

Source: Mitre, NVD

Published: 2026-10-23

Updated: 2026-10-23

Risk Information

CVSS v2

Base Score: 5

Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:N/A:N

Severity: Medium

CVSS v3

Base Score: 5.3

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Severity: Medium

CVSS v4

Base Score: 8.7

Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Severity: High