# GTM4WP <= 2.0.5 - Unauthenticated Sensitive Information Exposure via Cached Custom Order Received Page

- **ID:** WPSEC-2026-0885
- **Plugin:** GTM4WP – A Google Tag Manager (GTM) plugin for WordPress (`duracelltomi-google-tag-manager`), https://wordpress.org/plugins/duracelltomi-google-tag-manager/
- **Affected versions:** from 2.0.0 before 2.0.6
- **Fixed in:** 2.0.6 (Update to 2.0.6 or later.)
- **Severity:** Low 3.7 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N)
- **Weakness:** CWE-524
- **Usage among sites WPSec scans:** plugin High, affected versions High (as of 2026-10-14)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/duracelltomi-google-tag-manager
- **Fix released:** 2026-10-12
- **Published:** 2026-10-14
- **URL:** https://wpsec.com/vuln/WPSEC-2026-0885/

## Description

The GTM4WP – A Google Tag Manager (GTM) plugin for WordPress plugin for WordPress is vulnerable to Sensitive Information Exposure via the Custom Order Received Page feature in all versions from 2.0.0 up to, and including, 2.0.5. This is due to the configured custom order received page rendering the buyer's order and purchase data into the data layer without being excluded from page caches. The page uses a plain URL and the order is looked up from the visitor's WooCommerce session. This makes it possible for unauthenticated attackers to view another customer's order details served from a page cache. Depending on the plugin's settings, these details can include billing and shipping name, address, email and phone. Exploitation requires a full-page caching layer and the Custom Order Received Page option to be configured.

## References

- https://wpsec.com/vuln/WPSEC-2026-0885/
- https://plugins.svn.wordpress.org/duracelltomi-google-tag-manager/tags/2.0.6/
- https://wordpress.org/plugins/duracelltomi-google-tag-manager/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-0885/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.