GTM Server Side Plugin Vulnerability (CVE-2026-55826)

Security Alert Summary

The GTM Server Side plugin by stape.io contains a vulnerability (CVE-2026-55826) that allowed an unauthenticated attacker to trigger the rendering of another customers full WooCommerce order data, including personally identifiable information (PII), into a pages JavaScript dataLayer. The issue is documented as fixed in version 2.1.48.

CVE Details

• CVE ID: CVE-2026-55826
• Affected component: GTM Server Side plugin by stape.io (WooCommerce purchase event tracking mechanism)
• Affected versions: >= 2.0.0, < 2.1.48
• Published: October 23, 2026 at 02:17:54 PM
• Last modified: October 23, 2026 at 02:17:54 PM
• CVSS (4.0): base score 8.7, severity HIGH, vector CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
• Authentication / privileges / user interaction: No authentication required; privileges required: none; user interaction: none
• Primary impact: Confidentiality: HIGH; Integrity: NONE; Availability: NONE
• Weakness (CWE): CWE-200 (Information Exposure)

Technical Details

According to the advisory, the vulnerability is in the plugins WooCommerce purchase event tracking mechanism. An unauthenticated actor could cause the tracking flow to render another customer’s full order data, including PII, into the page JavaScript dataLayer. Because the dataLayer is typically accessible to page scripts and may be visible to other components on the page, this results in exposure of order-level information to the client-side context.

The advisory notes the issue was addressed in version 2.1.48. No additional function names or REST endpoints were specified in the provided data.

How This Could Impact Your Website

On a WooCommerce site using the affected GTM Server Side plugin, an attacker could cause customer order data from one user to be injected into the JavaScript dataLayer seen by another user or visitor. In a typical small business scenario, this could expose order details and PII that include customer names, email addresses, and order contents. Possible practical consequences include:

• Exposure of internal or customer email addresses and order details to unintended parties.
• Increased risk of targeted phishing or social engineering against customers or staff whose contact information is exposed.
• Unintended disclosure to third-party scripts or analytics tools that read the page dataLayer.

If youre unsure whether your site is affected or how to assess your current user roles and plugins, it may be worth having a professional review of your setup.

Recommended Actions

• Update the affected plugin to version 2.1.48 or later as soon as possible.
• Review and reduce unnecessary user roles and permissions, especially contributor-level or contractor accounts.
• Enforce strong passwords and enable two-factor authentication for editor and administrator accounts.
• Remove unused or unmaintained plugins to reduce attack surface.
• Monitor site activity and logs for unusual behavior, especially around order processing and tracking code.

If youd like help reviewing your plugins, user roles, or overall WordPress security posture, our team at Freshy is happy to help.

References

• http://github.com/stape-io/gtm-server-side-wordpress-plugin/tree/v2.1.47
• https://github.com/stape-io/gtm-server-side-wordpress-plugin/commit/702898f57772279ca63d3f800336c1803103ea41
• https://github.com/stape-io/gtm-server-side-wordpress-plugin/commit/9ff46a050028c40fad5416f2fa35be574c823434
• https://github.com/stape-io/gtm-server-side-wordpress-plugin/releases/tag/2.1.48
• https://github.com/stape-io/gtm-server-side-wordpress-plugin/security/advisories/GHSA-j5j2-gr8c-8rvf
• https://github.com/stape-io/gtm-server-side-wordpress-plugin/tree/v2.1.48