{
 "id": "WPSEC-2026-0885",
 "url": "https://wpsec.com/vuln/WPSEC-2026-0885/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-0885/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-0885/index.md",
 "title": "GTM4WP <= 2.0.5 - Unauthenticated Sensitive Information Exposure via Cached Custom Order Received Page",
 "description": "The GTM4WP – A Google Tag Manager (GTM) plugin for WordPress plugin for WordPress is vulnerable to Sensitive Information Exposure via the Custom Order Received Page feature in all versions from 2.0.0 up to, and including, 2.0.5. This is due to the configured custom order received page rendering the buyer's order and purchase data into the data layer without being excluded from page caches. The page uses a plain URL and the order is looked up from the visitor's WooCommerce session. This makes it possible for unauthenticated attackers to view another customer's order details served from a page cache. Depending on the plugin's settings, these details can include billing and shipping name, address, email and phone. Exploitation requires a full-page caching layer and the Custom Order Received Page option to be configured.",
 "plugin": {
  "slug": "duracelltomi-google-tag-manager",
  "name": "GTM4WP",
  "full_name": "GTM4WP – A Google Tag Manager (GTM) plugin for WordPress",
  "wordpress_org": "https://wordpress.org/plugins/duracelltomi-google-tag-manager/",
  "advisories_url": "https://wpsec.com/vuln/plugin/duracelltomi-google-tag-manager/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/duracelltomi-google-tag-manager"
 },
 "type": "SENSITIVE DATA DISCLOSURE",
 "cwe": [
  "CWE-524"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 3.7,
  "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N",
  "severity": "Low"
 },
 "affected": {
  "ranges": [
   {
    "from": "2.0.0",
    "from_inclusive": true,
    "to": "2.0.6",
    "to_inclusive": false
   }
  ],
  "text": [
   "from 2.0.0 before 2.0.6"
  ]
 },
 "introduced_in": "2.0.0",
 "fixed_in": "2.0.6",
 "remediation": "Update to 2.0.6 or later.",
 "fix_released": "2026-10-12T07:33:53+00:00",
 "published": "2026-10-14T12:52:26+00:00",
 "updated": "2026-10-14T12:13:03.862142+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-0885/",
  "https://plugins.svn.wordpress.org/duracelltomi-google-tag-manager/tags/2.0.6/",
  "https://wordpress.org/plugins/duracelltomi-google-tag-manager/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/duracelltomi-google-tag-manager",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "High",
  "affected_versions": "High",
  "as_of": "2026-10-14"
 }
}