stape-io vulnerabilities

Products

• gtm-server-side-wordpress-plugin 1

Latest stape-io CVEs

Newest publication first

1. CVE-2026-55826 Customer Order Data Exposed via Unauthenticated gtm_server_side_order_id Cookie Manipulation in GTM Server Side WordPress Plugin

   Published 2026-10-23

   High·CVSS 8.7 EPSS 0.34%

   The GTM Server Side plugin by stape.io implements server-side tracking on WordPress websites. From version 2.0.0 to before version 2.1.48, the WooCommerce purchase event tracking mechanism allows an unauthenticated attacker to trigger the rendering of another customer's full orde...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.