GTM Server Side EUVD-2026-108976

WooCommerce must be installed and active and the plugin's 'Ecommerce' dataLayer feature must be enabled; this is the core prerequisite. In versions 2.0.0-2.1.46 the primary trigger is direct manipulation of the unauthenticated, integrity-free client-side gtm_server_side_order_id cookie set to any valid (sequential, easily enumerated) order ID, after which the purchase event renders on any page because the is_wc_endpoint_url('order-received') guard was commented out. Full PII exposure (customer name, email, billing address, new/returning status) additionally requires the plugin's 'User Data' option to be enabled; without it, exposure is limited to non-PII order/transaction fields. In version 2.1.47 the direct cookie vector is closed (order ID moved to WC()->session), so residual exposure is limited to deployments running a full-page caching plugin (e.g., WP Rocket, LiteSpeed Cache, W3 Total Cache) that can cache and replay a legitimate purchase dataLayer to later visitors. Version 2.1.48 removes all of these conditions.

Signals are moderately strong but not emergency-grade. The CVSS 4.0 vector (AV:N/AC:L/PR:N/UI:N, VC:H) correctly reflects a remotely reachable, unauthenticated confidentiality breach with no user interaction, yielding the published 8.7. The vuln.today decision label is 'this_week' (not act_now/emergency), consistent with a serious-but-not-wormable information-disclosure flaw. No EPSS score was provided, and the CVE is NOT in CISA KEV, so there is no evidence of active exploitation. A detailed reproduction PoC is published inside the GHSA advisory, but the input does not mark it as confirmed working exploit code. The flaw is real and easy to trigger (sequential, enumerable order IDs; a client-settable cookie with no integrity protection in versions 2.0.0-2.1.46), which argues for prompt patching; however, impact is bounded to confidentiality of WooCommerce order data (I and A are N), and exploitation is gated on specific plugin/feature configuration. Net: a genuine priority for affected WooCommerce sites, but not a drop-everything event absent KEV or EPSS corroboration. One data conflict to verify: the package-metadata line states 'fixed in >= 2.1.47,' while the vendor GHSA advisory explicitly states 2.1.47 is only a partial fix and 2.1.48 is the first fully remediated release - treat 2.1.48 as the fixed version.

On a vulnerable site (plugin 2.0.0-2.1.46 with WooCommerce and the Ecommerce dataLayer feature active), an unauthenticated attacker sets the client-side gtm_server_side_order_id cookie to a guessed sequential order ID, loads any page, and reads the targeted customer's full purchase dataLayer - including name, email, and billing address when the 'User Data' option is enabled. A step-by-step public PoC reference exists in the GHSA advisory (it is not verified as working exploit code). On 2.1.47 sites, the residual risk shifts to full-page caching plugins inadvertently caching and replaying a real customer's purchase dataLayer to later anonymous visitors.