CVE-2026-55826: gtm-server-side-wordpress-plugin >= 2.0.0, < 2.1.48

Affected technology

gtm-server-side-wordpress-plugin · >= 2.0.0, < 2.1.48
stape-io

Component: Not specified by the source

Attack conditions (Vendor/CNA, CVSS 4.0): Network (remote) · No privileges required · No user interaction required

What an attacker can do

An unauthenticated attacker can trigger the rendering of another customer's full order data — including personally identifiable information (PII) — into the page's JavaScript dataLayer. Vendor/CNA’s CVSS 4.0 assessment (base score 8.7/10) rates confidentiality impact as high; integrity and availability impact as none.