Read the docs
TI-2026-87001 Aliases CVE-2026-123145

Stripe Payment Gateway for WooCommerce stores passwords in plaintext

Priority LOW 38Published · Updated

Key facts

Attack vector
—
Privileges required
—
User interaction
—
Attack complexity
—
Impact type
—
Confidentiality · integrity · availability
—
Fix status
Fixed

No CVSS vector from any source. Fix status from CNA.

Summary

The WooCommerce Stripe Payment Gateway WordPress plugin from 10.9.0 before 11.1.0 saves the account password a customer chooses during express checkout to order metadata in plaintext. Anyone with access to order data or the database can read these passwords. A public exploit is linked in the references.

Written with Claude Haiku 5.5 from the sources below · 2026-11-09

Description from the CNA

The WooCommerce Stripe Payment Gateway WordPress plugin before 11.1.0 does not exclude the account password from the checkout fields it saves to order metadata during express checkout, causing the password a customer chooses when creating an account at checkout to be stored in plaintext in the database, readable by anyone with access to order data or the database. Version 10.9.0 stored the passwords. Version 10.9.1 stopped new ones from being stored but left existing ones in place, and version 11.1.0 removes them on update. Passwords stored this way should be considered exposed.

Why it matters now

Public exploit Yes 1 exploit referenceTagged by the CNA
Fix Fixed WooCommerce Stripe Payment Gateway (Unknown): 11.1.0

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
UnknownWooCommerce Stripe Payment Gateway10.9.0 to before 11.1.011.1.0Patch availableCNA
  • WooCommerce Stripe Payment Gateway VendorUnknown Affected 10.9.0 to before 11.1.0 Fixed in 11.1.0 Patch available CNA

Remediation

Update the WooCommerce Stripe Payment Gateway plugin to version 11.1.0, which removes existing stored passwords on update. Passwords stored by affected versions should be considered exposed.

Written with Claude Haiku 5.5 from the sources below · 2026-11-09

  • Fix · CNA WooCommerce Stripe Payment Gateway (Unknown) Fixed in 11.1.0

Timeline

  1. 2026-11-09 Threatist record created from CVE-2026-123145

References

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences