Live › vulnerability › CVE-2026-55826
Go to dashboardThe GTM Server Side WordPress plugin, versions 2.0.0 to before 2.1.48, lets an unauthenticated visitor trigger another customer's full WooCommerce order details, including personal data, into the page's JavaScript dataLayer. An attacker can read customer PII from a store page without logging in.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
No product ranges from the sources yet.
Check the installed plugin version in WordPress admin under Plugins, or run: wp plugin get gtm-server-side --field=version (slug unknown, verify)
Update the GTM Server Side plugin to version 2.1.48 or later.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
The GTM Server Side plugin by stape.io implements server-side tracking on WordPress websites. From version 2.0.0 to before version 2.1.48, the WooCommerce purchase event tracking mechanism allows an unauthenticated attacker to trigger the rendering of another customer's full order data — including personally identifiable information (PII) — into the page's JavaScript dataLayer. This issue has been patched in version 2.1.48.
This page as .md · .json · in your agent: get_signal("CVE-2026-55826")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.