---
id: CVE-2026-55826
title: >-
  Customer Order Data Exposed via Unauthenticated gtm_server_side_order_id
  Cookie Manipulation in GTM Server Side WordPress Plugin
summary: >-
  The GTM Server Side plugin by stape.io implements server-side tracking on
  WordPress websites. From version 2.0.0 to before version 2.1.48, the
  WooCommerce purchase event tracking mechanism allows an unauthenticated
  attacker to trigger th…
severity: high
cvss: 8.7
cvssVector: 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N'
cvssSource: cna
cwe:
  - CWE-200
vendor: stape-io
product: gtm-server-side-wordpress-plugin
affected:
  - 'gtm-server-side-wordpress-plugin >= 2.0.0, < 2.1.48'
published: '2026-10-23'
updated: '2026-10-23'
sourceUpdated: '2026-10-23T13:27:45.250Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-55826'
references:
  - url: >-
      https://github.com/stape-io/gtm-server-side-wordpress-plugin/security/advisories/GHSA-j5j2-gr8c-8rvf
    label: >-
      https://github.com/stape-io/gtm-server-side-wordpress-plugin/security/advisories/GHSA-j5j2-gr8c-8rvf
  - url: >-
      https://github.com/stape-io/gtm-server-side-wordpress-plugin/commit/702898f57772279ca63d3f800336c1803103ea41
    label: >-
      https://github.com/stape-io/gtm-server-side-wordpress-plugin/commit/702898f57772279ca63d3f800336c1803103ea41
  - url: >-
      https://github.com/stape-io/gtm-server-side-wordpress-plugin/commit/9ff46a050028c40fad5416f2fa35be574c823434
    label: >-
      https://github.com/stape-io/gtm-server-side-wordpress-plugin/commit/9ff46a050028c40fad5416f2fa35be574c823434
  - url: >-
      https://github.com/stape-io/gtm-server-side-wordpress-plugin/releases/tag/2.1.48
    label: >-
      https://github.com/stape-io/gtm-server-side-wordpress-plugin/releases/tag/2.1.48
  - url: 'https://github.com/stape-io/gtm-server-side-wordpress-plugin/tree/v2.1.48'
    label: 'https://github.com/stape-io/gtm-server-side-wordpress-plugin/tree/v2.1.48'
  - url: 'http://github.com/stape-io/gtm-server-side-wordpress-plugin/tree/v2.1.47'
    label: 'http://github.com/stape-io/gtm-server-side-wordpress-plugin/tree/v2.1.47'
tags:
  - cve.org
ingestedAt: '2026-10-23T14:28:08.709Z'
---

## Overview

The GTM Server Side plugin by stape.io implements server-side tracking on WordPress websites. From version 2.0.0 to before version 2.1.48, the WooCommerce purchase event tracking mechanism allows an unauthenticated attacker to trigger the rendering of another customer's full order data — including personally identifiable information (PII) — into the page's JavaScript dataLayer. This issue has been patched in version 2.1.48.

## Affected

- `gtm-server-side-wordpress-plugin >= 2.0.0, < 2.1.48`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.