Stape GTM Server Side plugin: Exposure of customer order data
Summary
The GTM Server Side plugin by stape.io for WordPress contains an information disclosure flaw in its WooCommerce purchase event tracking. An unauthenticated visitor can cause the full order data of another customer, including personally identifiable information, to be rendered into the page's JavaScript dataLayer. The flaw is reachable over the network without privileges or user interaction, and the issue is tracked as CWE-200.
Affected
- stape.io GTM Server Side WordPress plugin (Stape Conversion Tracking), versions 2.0.0 up to and excluding 2.1.48
Fixed in
- Fixed in version 2.1.48
Workaround
- Unknown. The vendor sources only point to upgrading. Interim measure (own analysis, not vendor-confirmed): deactivate the plugin or its WooCommerce purchase tracking until the update is applied.
Exploitation
- No evidence of exploitation in the wild found. CISA SSVC: Exploitation none, Automatable yes, Technical Impact partial.
- Public proof-of-concept: unknown.
- Not listed in CISA KEV according to one tracker.
Our recommendation
- Update the GTM Server Side plugin to version 2.1.48 or later on all WordPress sites immediately.
- Inventory all WordPress sites with this plugin, including those managed by agencies.
- Check public pages for exposed order data in the page source if the plugin was running in an affected version.
- If customer data was exposed, assess whether this is a reportable data breach under the Swiss FADP (revDSG) with your legal advisor.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- CVE record NVD vulners.com
- GitHub security advisory GHSA-j5j2-gr8c-8rvf github.com
- GitHub release 2.1.48 github.com
- Fix commit 702898f github.com
- VulDB CVE-2026-55826 vuldb.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 00:27.
Original description (NVD)
The GTM Server Side plugin by stape.io implements server-side tracking on WordPress websites. From version 2.0.0 to before version 2.1.48, the WooCommerce purchase event tracking mechanism allows an unauthenticated attacker to trigger the rendering of another customer's full order data — including personally identifiable information (PII) — into the page's JavaScript dataLayer. This issue has been patched in version 2.1.48.
NVD references (6)
- http://github.com/stape-io/gtm-server-side-wordpress-plugin/tree/v2.1.47
- https://github.com/stape-io/gtm-server-side-wordpress-plugin/commit/702898f57772279ca63d3f800336c1803103ea41
- https://github.com/stape-io/gtm-server-side-wordpress-plugin/commit/9ff46a050028c40fad5416f2fa35be574c823434
- https://github.com/stape-io/gtm-server-side-wordpress-plugin/releases/tag/2.1.48
- https://github.com/stape-io/gtm-server-side-wordpress-plugin/security/advisories/GHSA-j5j2-gr8c-8rvf
- https://github.com/stape-io/gtm-server-side-wordpress-plugin/tree/v2.1.48
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.