HT Easy GA4 ( Google Analytics 4 ) <= 1.9.4 - Unauthenticated Insecure Direct Object Reference to Order Data Exposure via 'order' Parameter
- ID
- WPSEC-2026-0128
- Plugin
- HT Easy GA4 – Google Analytics WordPress Plugin (ht-easy-google-analytics)
- Affected
- from 1.8.0 before 1.9.5
- Remediation
- Update to 1.9.5 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
- Weakness
- CWE-639
- Usage
- Plugin Low · Affected versions None seen among sites WPSec scans, 2026-10-22
- Attack surface
- HT Easy GA4 ( Google Analytics 4 ) on WPSec AttackSurface
- Fix released
- Published
Description
The HT Easy GA4 – Google Analytics WordPress Plugin plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions 1.8.0 up to, and including, 1.9.4. On the WooCommerce order-received page, the purchase data layer script takes the order ID from the user-controlled 'order' parameter (or the order-received URL segment) and never checks the order key. This makes it possible for unauthenticated attackers to enumerate order IDs and view other customers' purchase details, such as items, totals, coupon codes and payment method, in the rendered data layer script. The purchase event tracking option must be enabled and server-side tracking disabled.
References
- https://wpsec.com/vuln/WPSEC-2026-0128/
- https://plugins.svn.wordpress.org/ht-easy-google-analytics/tags/1.9.5/
- https://wordpress.org/plugins/ht-easy-google-analytics/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS