VulnSocial

CVE-2026-55826

LOWCVSS 8.7 · HIGH

Immediate actions

  • Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

The GTM Server Side plugin by stape.io implements server-side tracking on WordPress websites. From version 2.0.0 to before version 2.1.48, the WooCommerce purchase event tracking mechanism allows an unauthenticated attacker to trigger the rendering of another customer's full order data — including personally identifiable information (PII) — into the page's JavaScript dataLayer. This issue has been patched in version 2.1.48.

Back to dashboard
0.0/ 10 priority

Sources & remediation

Other references
Weakness type (CWE)
CWE-200

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

NONE

Momentum

NONE

Deep dive

Full discourse1 post
  • Donweb Media@DonwebMedia

    Si tenés WooCommerce con GTM Server Side, revisá ya: encontraron una vulnerabilidad (CVSS 8.7) que puede filtrar datos de pedidos ajenos a través del dataLayer. Actualizá a la 2.1.48 y lis https://seguridadenwordpress.com/vulnerabilidad-gtm-server-side-woocommerce-cve-2026-55826/

    0000027
    9 followersView on X

Explore more

Back to dashboard