GTM4WP <= 2.0.5 - Unauthenticated Sensitive Information Exposure via Cached Custom Order Received Page
- ID
- WPSEC-2026-0885
- Plugin
- GTM4WP – A Google Tag Manager (GTM) plugin for WordPress (duracelltomi-google-tag-manager)
- Affected
- from 2.0.0 before 2.0.6
- Remediation
- Update to 2.0.6 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
- Weakness
- CWE-524
- Usage
- Plugin High · Affected versions High among sites WPSec scans, 2026-10-14
- Attack surface
- GTM4WP on WPSec AttackSurface
- Fix released
- Published
Description
The GTM4WP – A Google Tag Manager (GTM) plugin for WordPress plugin for WordPress is vulnerable to Sensitive Information Exposure via the Custom Order Received Page feature in all versions from 2.0.0 up to, and including, 2.0.5. This is due to the configured custom order received page rendering the buyer's order and purchase data into the data layer without being excluded from page caches. The page uses a plain URL and the order is looked up from the visitor's WooCommerce session. This makes it possible for unauthenticated attackers to view another customer's order details served from a page cache. Depending on the plugin's settings, these details can include billing and shipping name, address, email and phone. Exploitation requires a full-page caching layer and the Custom Order Received Page option to be configured.
References
- https://wpsec.com/vuln/WPSEC-2026-0885/
- https://plugins.svn.wordpress.org/duracelltomi-google-tag-manager/tags/2.0.6/
- https://wordpress.org/plugins/duracelltomi-google-tag-manager/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS