---
id: "CVE-2026-55826"
kind: "vulnerability"
aliases: ["CVE-2026-55826"]
title: "WordPress GTM Server Side plugin leaks other customers' order data"
severity: "high"
cvss: 8.7
epss: 0.00593
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["e-commerce", "gtm-server-side", "package", "woocommerce", "wordpress"]
not_affected_if: ["plugin-version-2.1.48-or-later", "woocommerce-not-used"]
published_at: "2026-10-23T14:17:54+00:00"
first_seen_at: "2026-10-23T21:57:34+00:00"
updated_at: "2026-10-25T12:38:49+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-55826", "first_seen_at": "2026-10-23T21:57:34+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-55826", "first_seen_at": "2026-10-25T12:38:49+00:00"}]
---

# WordPress GTM Server Side plugin leaks other customers' order data

The GTM Server Side WordPress plugin, versions 2.0.0 to before 2.1.48, lets an unauthenticated visitor trigger another customer's full WooCommerce order details, including personal data, into the page's JavaScript dataLayer. An attacker can read customer PII from a store page without logging in.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

Check the installed plugin version in WordPress admin under Plugins, or run: wp plugin get gtm-server-side --field=version (slug unknown, verify)

## Fix

Update the GTM Server Side plugin to version 2.1.48 or later.

## Timeline

- 2026-10-23T21:57:34+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-55826
- 2026-10-25T12:38:49+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-55826

## From the sources

The GTM Server Side plugin by stape.io implements server-side tracking on WordPress websites. From version 2.0.0 to before version 2.1.48, the WooCommerce purchase event tracking mechanism allows an unauthenticated attacker to trigger the rendering of another customer's full order data — including personally identifiable information (PII) — into the page's JavaScript dataLayer. This issue has been patched in version 2.1.48.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_