An unauthenticated attacker can manipulate the gtm_server_side_order_id cookie in the GTM Server Side WordPress plugin to force the plugin to render another customer’s full order details, including personally identifiable information, into the page’s JavaScript dataLayer. The flaw allows confidentiality breach without any authentication, leading to exposure of sensitive purchase data.

The vulnerability affects stape.io’s GTM Server Side WordPress plugin in all releases from version 2.0.0 up to and including 2.1.47. Versions 2.1.48 and later contain the patch that removes the flaw.

With a CVSS score of 8.7, the risk is high. The EPSS score is unavailable, but the flaw is not listed in the CISA KEV catalog, suggesting it is not presently known as a widely exploited vulnerability. The attack can be carried out by creating or modifying the gtm_server_side_order_id cookie and triggering the plugin’s rendering process, which does not require any user authentication. If an attacker can forge or set this cookie, the resulting dataLayer will contain the order data of others, thereby facilitating a data disclosure attack.