CVE-2026-55826 - The GTM Server Side plugin by stape.io implements server-side tracking on WordPress websites. From version 2.0.0 to befo

The GTM Server Side plugin by stape.io implements server-side tracking on WordPress websites. From version 2.0.0 to before version 2.1.48, the WooCommerce purchase event tracking mechanism allows an unauthenticated attacker to trigger the rendering of another customer's full order data — including personally identifiable information (PII) — into the page's JavaScript dataLayer. This issue has been patched in version 2.1.48.

INFORMATIONAL

Severity & confidence

Source severityinformational

Platform severityinformational

Confidencehigh

Exploitationunknown

CVSS-

Affected

Vendorswordpress

Reporting sources (1)

NIST NVD - National Vulnerability Database

Open source ↗

Timeline & provenance

Published2026-10-23T14:17:54

Last updated2026-10-26T14:17:11

Ingested2026-10-25T19:54:40

FreshnessNEAR-REAL-TIME

Threat typevulnerability

Recommended action

No recommended action published with this item - review the original source.

Next steps

Identify affected systems in your environment.
Apply the vendor patch or mitigation guidance.
Review logs for indicators described in the advisory.
Follow the affected vendor/product to track updates.

Confidence explanation

Reported by a government or cert-grade source (CISA, NCSC, NVD, ENISA, MSRC).

Source type: standards · Original: NIST NVD - National Vulnerability Database