CVE-2026-123145 · Package
NO FIX YET · SEE WHAT TO DO
The WooCommerce Stripe Payment Gateway plugin saves the password a customer picks at checkout into order metadata in plaintext. Anyone who can read order data or the database can read those passwords, which customers may reuse elsewhere.
first public Nov 9, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Stores that run the WooCommerce Stripe Payment Gateway plugin and offer express checkout with account creation are exposed. Versions 10.9.0 through earlier releases stored the passwords; 10.9.1 stopped new storage but left existing passwords in place until 11.1.0 removed them. Anyone with access to order data or the database can read the stored passwords, so sites that do not use express checkout account creation can skip it.
Not affected if plugin-at-11.1.0-or-later, plugin-not-installed
Who cares self-hosted, stripe, woocommerce, wordpress
11.1.0 are affected.10.9.0 at any point, since those versions stored passwords.11.1.0 or later, which removes the stored passwords on update.The WooCommerce Stripe Payment Gateway WordPress plugin before 11.1.0 does not exclude the account password from the checkout fields it saves to order metadata during express checkout, causing the password a customer chooses when creating an account at checkout to be stored in plaintext in the database, readable by anyone with access to order data or the database. Version 10.9.0 stored the passwords. Version 10.9.1 stopped new ones from being stored but left existing ones in place, and version 11.1.0 removes them on update. Passwords stored this way should be considered exposed.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.