Stripe Payment Gateway for WooCommerce stores passwords in plaintext
Key facts
- Attack vector
- —
- Privileges required
- —
- User interaction
- —
- Attack complexity
- —
- Impact type
- —
- Confidentiality · integrity · availability
- —
- Fix status
- Fixed
No CVSS vector from any source. Fix status from CNA.
Summary
The WooCommerce Stripe Payment Gateway WordPress plugin from 10.9.0 before 11.1.0 saves the account password a customer chooses during express checkout to order metadata in plaintext. Anyone with access to order data or the database can read these passwords. A public exploit is linked in the references.
Written with Claude Haiku 5.5 from the sources below · 2026-11-09
Description from the CNA
The WooCommerce Stripe Payment Gateway WordPress plugin before 11.1.0 does not exclude the account password from the checkout fields it saves to order metadata during express checkout, causing the password a customer chooses when creating an account at checkout to be stored in plaintext in the database, readable by anyone with access to order data or the database. Version 10.9.0 stored the passwords. Version 10.9.1 stopped new ones from being stored but left existing ones in place, and version 11.1.0 removes them on update. Passwords stored this way should be considered exposed.
Why it matters now
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Unknown | WooCommerce Stripe Payment Gateway | 10.9.0 to before 11.1.0 | 11.1.0 | Patch available | CNA |
- WooCommerce Stripe Payment Gateway VendorUnknown Affected 10.9.0 to before 11.1.0 Fixed in 11.1.0 Patch available CNA
Remediation
Update the WooCommerce Stripe Payment Gateway plugin to version 11.1.0, which removes existing stored passwords on update. Passwords stored by affected versions should be considered exposed.
Written with Claude Haiku 5.5 from the sources below · 2026-11-09
- Fix · CNA WooCommerce Stripe Payment Gateway (Unknown) Fixed in 11.1.0
Timeline
- 2026-11-09 Threatist record created from CVE-2026-123145
References
Sources
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences