CVE Hub
CVE-2026-55826
Customer Order Data Exposed via Unauthenticated gtm_server_side_order_id Cookie Manipulation in GTM Server Side WordPress Plugin
Fetching some sources has been requested. Reload in about a minute to see them.
CVSS v3.1 (listed by NVD)
—
Not scored
CVSS v4.0 (listed by NVD)
8.7
HIGH
Scored by github.com (not yet scored by NVD)
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS (listed by CVE.org)
8.7
HIGH
Scored by CNA (GitHub_M) · v4.0
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
EPSS exploit probability
0.6%
Percentile 47.7%
as of 2026-10-24
CISA KEV
—
Not listed
Attack conditions and impact
Derived from the CNA (via NVD) CVSS 4.0 vector
NetworkNo authNo interaction
Confidentiality HIntegrity NAvailability N
This vulnerability may be exploitable over the internet without authentication or user interaction.
| Metric | Value | Meaning |
|---|---|---|
| Attack vector AV | N | Network |
| Attack complexity AC | L | Low (easy) |
| Attack requirements AT | N | None |
| Privileges required PR | N | None |
| User interaction UI | N | None |
| Confidentiality (vulnerable system) VC | H | High |
| Integrity (vulnerable system) VI | N | None |
| Availability (vulnerable system) VA | N | None |
| Confidentiality (subsequent systems) SC | N | None |
| Integrity (subsequent systems) SI | N | None |
| Availability (subsequent systems) SA | N | None |
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Description
NVD
The GTM Server Side plugin by stape.io implements server-side tracking on WordPress websites. From version 2.0.0 to before version 2.1.48, the WooCommerce purchase event tracking mechanism allows an unauthenticated attacker to trigger the rendering of another customer's full order data — including personally identifiable information (PII) — into the page's JavaScript dataLayer. This issue has been patched in version 2.1.48.
CVSS assessments
| Provider | Version | Score | Vector |
|---|---|---|---|
| NVD / [email protected] (Secondary) | 4.0 | 8.7 HIGH | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
| CNA / GitHub_M | 4.0 | 8.7 HIGH | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N |
Affected products and packages
CNA (CVE.org)
| Vendor | Product | Versions |
|---|---|---|
| stape-io | gtm-server-side-wordpress-plugin | affected: >= 2.0.0, < 2.1.48 |
Linux distribution status
References (6)
- http://github.com/stape-io/gtm-server-side-wordpress-plugin/tree/v2.1.47 NVD, CNA x_refsource_MISC
- https://github.com/stape-io/gtm-server-side-wordpress-plugin/commit/702898f57772279ca63d3f800336c1803103ea41 NVD, CNA x_refsource_MISC
- https://github.com/stape-io/gtm-server-side-wordpress-plugin/commit/9ff46a050028c40fad5416f2fa35be574c823434 NVD, CNA x_refsource_MISC
- https://github.com/stape-io/gtm-server-side-wordpress-plugin/releases/tag/2.1.48 NVD, CNA x_refsource_MISC
- https://github.com/stape-io/gtm-server-side-wordpress-plugin/security/advisories/GHSA-j5j2-gr8c-8rvf NVD, CNA x_refsource_CONFIRM
- https://github.com/stape-io/gtm-server-side-wordpress-plugin/tree/v2.1.48 NVD, CNA x_refsource_MISC