{"id":"CVE-2026-123145","kind":"vulnerability","aliases":["CVE-2026-123145"],"related":[],"title":"WooCommerce Stripe Gateway plugin stores customer account passwords in plaintext","description":"The WooCommerce Stripe Payment Gateway WordPress plugin before 11.1.0 does not exclude the account password from the checkout fields it saves to order metadata during express checkout, causing the password a customer chooses when creating an account at checkout to be stored in plaintext in the database, readable by anyone with access to order data or the database. Version 10.9.0 stored the passwords. Version 10.9.1 stopped new ones from being stored but left existing ones in place, and version 11.1.0 removes them on update. Passwords stored this way should be considered exposed.","summary":"The WooCommerce Stripe Payment Gateway plugin saves the password a customer picks at checkout into order metadata in plaintext. Anyone who can read order data or the database can read those passwords, which customers may reuse elsewhere.","severity":"high","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["package","self-hosted","stripe","woocommerce","wordpress"],"not_affected_if":["plugin-at-11.1.0-or-later","plugin-not-installed"],"how_to_check":"- Check the installed plugin version in WordPress admin under Plugins; versions before `11.1.0` are affected.\n- Check whether the plugin was at `10.9.0` at any point, since those versions stored passwords.\n- Search the order metadata in the database for plaintext password values saved on orders created through express checkout.","fix":"- WooCommerce Stripe Payment Gateway: update to `11.1.0` or later, which removes the stored passwords on update.","status":"open","published_at":"2026-11-09T07:17:30+00:00","first_seen_at":"2026-11-09T07:25:05+00:00","triaged_at":"2026-11-09T07:25:36+00:00","updated_at":"2026-11-09T07:25:36+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-11-09T07:25:36Z","model":"claude-haiku-5-5","output":{"fix":"- WooCommerce Stripe Payment Gateway: update to `11.1.0` or later, which removes the stored passwords on update.","reach":"local","title":"WooCommerce Stripe Gateway plugin stores customer account passwords in plaintext","impact":"medium","summary":"The WooCommerce Stripe Payment Gateway plugin saves the password a customer picks at checkout into order metadata in plaintext. Anyone who can read order data or the database can read those passwords, which customers may reuse elsewhere.","audience":"businesses","category":"package","nicknames":[],"who_cares":["woocommerce","wordpress","stripe","self-hosted"],"confidence":0.7,"fix_status":"available","needs_auth":"yes","worst_case":"customer account passwords readable in plaintext from the database","analyst_note":"Confirm the affected version range and whether 10.9.1 through 11.0.x still store passwords; only the NVD entry was consulted.","how_to_check":"- Check the installed plugin version in WordPress admin under Plugins; versions before `11.1.0` are affected.\n- Check whether the plugin was at `10.9.0` at any point, since those versions stored passwords.\n- Search the order metadata in the database for plaintext password values saved on orders created through express checkout.","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["plugin-not-installed","plugin-at-11.1.0-or-later"],"who_is_affected":"Stores that run the WooCommerce Stripe Payment Gateway plugin and offer express checkout with account creation are exposed. Versions 10.9.0 through earlier releases stored the passwords; 10.9.1 stopped new storage but left existing passwords in place until 11.1.0 removed them. Anyone with access to order data or the database can read the stored passwords, so sites that do not use express checkout account creation can skip it.","user_interaction":"yes","product_ecosystem":"","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.000811,"input_tokens":4636,"output_tokens":694,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-123145':13A,16A '-2026':12A,15A '10.9.0':120C '10.9.1':125C '11.1.0':69C,140C 'access':112C 'account':7A,74C,97C 'anyon':43B,110C 'caus':88C 'checkout':37B,78C,87C,99C 'choos':93C 'consid':151C 'creat':95C 'custom':6A,34B,57B,92C 'cve':11A,14A 'data':48B,115C 'databas':51B,107C,118C 'elsewher':60B 'exclud':72C 'exist':134C 'expos':152C 'express':86C 'field':79C 'gateway':3A,28B,65C 'host':20B 'left':133C 'may':58B 'metadata':40B,84C 'new':127C 'one':128C,135C 'order':39B,47B,83C,114C 'packag':17B 'password':8A,32B,55B,75C,90C,123C,145C 'payment':27B,64C 'pick':35B 'place':137C 'plaintext':10A,42B,104C 'plugin':4A,29B,67C 'read':46B,53B 'readabl':108C 'remov':141C 'reus':59B 'save':30B,81C 'self':19B 'self-host':18B 'stop':126C 'store':5A,102C,121C,131C,146C 'stripe':2A,21B,26B,63C 'updat':144C 'version':119C,124C,139C 'way':148C 'woocommerc':1A,22B,25B,62C 'wordpress':23B,66C","nicknames":[],"mitigations":[],"who_affected":"Stores that run the WooCommerce Stripe Payment Gateway plugin and offer express checkout with account creation are exposed. Versions 10.9.0 through earlier releases stored the passwords; 10.9.1 stopped new storage but left existing passwords in place until 11.1.0 removed them. Anyone with access to order data or the database can read the stored passwords, so sites that do not use express checkout account creation can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["high","package","selfhosted","stripe","woocommerce","wordpress"],"campaign_type":null,"search_a":"'-123145':13A,16A '-2026':12A,15A 'account':7A 'custom':6A 'cve':11A,14A 'gateway':3A 'password':8A 'plaintext':10A 'plugin':4A 'store':5A 'stripe':2A 'woocommerc':1A","search_b":"'anyon':43B 'checkout':37B 'custom':34B,57B 'data':48B 'databas':51B 'elsewher':60B 'gateway':28B 'host':20B 'may':58B 'metadata':40B 'order':39B,47B 'packag':17B 'password':32B,55B 'payment':27B 'pick':35B 'plaintext':42B 'plugin':29B 'read':46B,53B 'reus':59B 'save':30B 'self':19B 'self-host':18B 'stripe':21B,26B 'woocommerc':22B,25B 'wordpress':23B","search_c":"'10.9.0':120C '10.9.1':125C '11.1.0':69C,140C 'access':112C 'account':74C,97C 'anyon':110C 'caus':88C 'checkout':78C,87C,99C 'choos':93C 'consid':151C 'creat':95C 'custom':92C 'data':115C 'databas':107C,118C 'exclud':72C 'exist':134C 'expos':152C 'express':86C 'field':79C 'gateway':65C 'left':133C 'metadata':84C 'new':127C 'one':128C,135C 'order':83C,114C 'password':75C,90C,123C,145C 'payment':64C 'place':137C 'plaintext':104C 'plugin':67C 'readabl':108C 'remov':141C 'save':81C 'stop':126C 'store':102C,121C,131C,146C 'stripe':63C 'updat':144C 'version':119C,124C,139C 'way':148C 'woocommerc':62C 'wordpress':66C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-09T07:17:30+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-123145","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-123145","severity":null,"published_at":"2026-11-09T07:17:30+00:00","modified_at":"2026-11-09T07:17:30+00:00","first_seen_at":"2026-11-09T07:25:05+00:00","fetched_at":"2026-11-09T07:25:05+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}