Security Alert Summary
The WooCommerce Stripe Payment Gateway plugin stored customer account passwords in plaintext in order metadata during express checkout in affected versions. Passwords chosen by customers when creating an account at checkout were saved to the database and remained readable by anyone with access to order data or the database. Later versions address storage of new passwords and removal of previously stored values.
CVE Details
- CVE ID: CVE-2026-123145
- Affected plugin / component: WooCommerce Stripe Payment Gateway (WordPress plugin)
- Affected versions: Versions before 11.1.0. The description notes version 10.9.0 stored passwords; version 10.9.1 stopped new ones from being stored but left existing stored passwords in place; version 11.1.0 removes stored passwords on update.
- Published: November 9, 2026 7:17 AM UTC
- Last modified: November 9, 2026 3:17 PM UTC
- CVSS v3.1: Base score 4.4 (MEDIUM) — Vector: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:N
- Authentication / Privileges / User interaction: Authentication required: yes – attacker must be authenticated with high-level privileges (PR:H). Privileges required: High. User interaction: None.
- Primary impact: Confidentiality: High; Integrity: None; Availability: None.
- CWE / weakness: CWE-200 (Exposure of Sensitive Information)
Technical Details
When processing express checkout flows the plugin saved checkout fields to order metadata. The account password field that a customer may choose when creating an account at checkout was not excluded from the set of fields stored to order metadata. As a result, passwords were written to the database in plaintext and are readable by anyone with access to order records or direct database access.
According to the provided description, version 10.9.0 stored passwords in this way. Version 10.9.1 prevented new passwords from being stored but did not remove previously stored values, and version 11.1.0 removes those stored passwords during update. Passwords stored in order metadata should be considered exposed.
How This Could Impact Your Website
Consider a typical small business WordPress site using WooCommerce and the Stripe gateway with multiple users involved: the site owner, internal staff responsible for orders and support, and an external contractor or developer with access to order data or the database. If an account password chosen at checkout was stored in plaintext with order data, anyone who can view orders or query the database could read those passwords. That exposure increases the risk of account takeover where customers reuse passwords across sites and can also enable targeted social engineering or phishing by revealing which customers have accounts.
For example, an internal support employee or a contractor who has legitimate order access could unintentionally view stored passwords, or an attacker who gains access to database backups could extract them. While this vulnerability does not by itself indicate remote, unauthenticated access to your site, the presence of plaintext passwords in order metadata materially increases confidentiality risk for exposed accounts.
If youre unsure whether your site is affected or how to assess your current user roles and plugins, it may be worth having a professional review.
Recommended Actions
- Update the affected plugin to a version that removes stored passwords (the description indicates version 11.1.0 removes stored values on update).
- Identify and remove any plaintext passwords from order metadata and database backups where possible. Treat stored passwords as exposed and advise affected users to change passwords.
- Review and reduce unnecessary user roles and database access, especially for contractors and support staff.
- Enforce strong, unique passwords and enable two-factor authentication for editors and administrators.
- Remove unused or unmaintained plugins and limit plugins that store sensitive customer fields in order data.
- Monitor site and database activity for unusual behavior and review access logs for unauthorized access to order or database records.
If youd like help reviewing your plugins, user roles, or overall WordPress security posture, our team at Freshy is happy to help.
