CVE-2026-55826: Customer Order Data Exposed via Unauthenticated gtm_server_side_order_id Cookie Manipulation in GTM Server Side WordPress Plugin
Published Oct 23, 2026
·Updated
The GTM Server Side plugin by stape.io implements server-side tracking on WordPress websites. From version 2.0.0 to before version 2.1.48, the WooCommerce purchase event tracking mechanism allows an unauthenticated attacker to trigger the rendering of another customer's full order data — including personally identifiable information (PII) — into the page's JavaScript dataLayer. This issue has been patched in version 2.1.48.
Affected Software
1 affected component
stape.io GTM Server Side WordPress Plugin>=2.0.0<2.1.48
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
GTM Server Side WordPress Pluginto a version that resolves this vulnerability.Fixed in 2.1.48
Event History
Oct 23, 2026
CVE Published
via MITRE·01:27 PM
Data Sourced
via MITRE·01:27 PM
DescriptionWeakness