High severity · published Oct 23, 2026
CVE-2026-55826
Customer Order Data Exposed via Unauthenticated gtm_server_side_order_id Cookie Manipulation in GTM Server Side WordPress Plugin
New
8.7
CVSS
0.3%
EPSS
No
On KEV
Description
The GTM Server Side plugin by stape.io implements server-side tracking on WordPress websites. From version 2.0.0 to before version 2.1.48, the WooCommerce purchase event tracking mechanism allows an unauthenticated attacker to trigger the rendering of another customer's full order data — including personally identifiable information (PII) — into the page's JavaScript dataLayer. This issue has been patched in version 2.1.48.
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 27% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
GT
gtm-server-side-wordpress-plugin · stape-io
>= 2.0.0, < 2.1.48 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-55826
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-55826
github.com
http://github.com/stape-io/gtm-server-side-wordpress-plugin/tree/v2.1.47
github.com
https://github.com/stape-io/gtm-server-side-wordpress-plugin/commit/702898f57772279ca63d3f800336c1803103ea41
github.com
https://github.com/stape-io/gtm-server-side-wordpress-plugin/commit/9ff46a050028c40fad5416f2fa35be574c823434
github.com
https://github.com/stape-io/gtm-server-side-wordpress-plugin/releases/tag/2.1.48
github.com
https://github.com/stape-io/gtm-server-side-wordpress-plugin/security/advisories/GHSA-j5j2-gr8c-8rvf
github.com
https://github.com/stape-io/gtm-server-side-wordpress-plugin/tree/v2.1.48