CVE-2026-123145 in WooCommerce Stripe Payment Gateway Plugin
Summary
by MITRE • 11/09/2026
The WooCommerce Stripe Payment Gateway WordPress plugin before 11.1.0 does not exclude the account password from the checkout fields it saves to order metadata during express checkout, causing the password a customer chooses when creating an account at checkout to be stored in plaintext in the database, readable by anyone with access to order data or the database. Version 10.9.0 stored the passwords. Version 10.9.1 stopped new ones from being stored but left existing ones in place, and version 11.1.0 removes them on update. Passwords stored this way should be considered exposed.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 11/09/2026
The WooCommerce Stripe Payment Gateway plugin for WordPress versions prior to 11.1.0 contains a critical information disclosure vulnerability related to the handling of user credentials during the express checkout process. This flaw stems from an improper implementation of data sanitization and storage protocols within the plugin's account creation workflow. When customers utilize the express checkout feature, which often streamlines the purchasing experience by auto-filling or simplifying form fields, the plugin inadvertently captures and persists the password entered for new account registration directly into the order metadata stored in the WordPress database. This behavior represents a significant deviation from secure coding standards regarding credential management, as passwords should never be stored in plaintext under any circumstances, particularly within transactional data structures that are frequently accessed by various system components and administrative interfaces.
The technical root cause of this vulnerability lies in the plugin's failure to exclude sensitive authentication fields from the set of attributes saved during the checkout session processing. By treating the account password as a standard form field rather than recognizing it as highly sensitive security material, the software writes the plaintext value directly into the database tables associated with order metadata. This design oversight means that any individual or automated process capable of querying the WordPress database for order details will also retrieve these passwords alongside other transactional information such as billing addresses and payment tokens. The vulnerability affects users who have not yet upgraded to version 11.1.0, including those on versions like 10.9.0 where this behavior was present from the outset, and those on intermediate releases like 10.9.1 which halted new exposures but retained existing plaintext passwords in storage.
The operational impact of this vulnerability is severe due to the high value placed on user credentials across interconnected digital ecosystems. Since WooCommerce integrates with numerous other plugins and services that may have access to order data, the exposure extends beyond direct database queries. Attackers who compromise an administrator account or exploit a separate cross-site scripting vulnerability could potentially extract these plaintext passwords from the metadata fields. Furthermore, because many users reuse passwords across multiple platforms, the leakage of WordPress credentials poses a substantial risk of credential stuffing attacks against other services where those same email and password combinations are used. This creates a cascading security failure that compromises not only the immediate e-commerce site but also potentially the personal accounts of customers who shop there.
From a classification perspective, this vulnerability aligns with CWE-256, which covers the storage of passwords in a recoverable format, specifically plaintext. It also relates to CWE-319 regarding cleartext transmission and storage of sensitive information within application data structures. In terms of attack vectors, this flaw facilitates unauthorized access through credential harvesting, mapping to MITRE ATT&CK techniques such as T1078 Valid Accounts if the stolen credentials are used for lateral movement or privilege escalation within a compromised environment. The persistence of these passwords in version 10.9.1 further exacerbates the risk by maintaining a historical record of exposed secrets that remain accessible until explicitly purged, highlighting the importance of proactive data hygiene and secure defaults in plugin development.
Mitigation strategies must address both immediate remediation and long-term security posture improvements. The primary action is to upgrade the WooCommerce Stripe Payment Gateway plugin to version 11.1.0 or later, which implements logic to remove existing plaintext passwords from order metadata during the update process. Administrators should verify that no residual password data remains in their database after upgrading by auditing relevant tables for anomalies in field lengths or formats consistent with hashed credentials versus plaintext strings. Additionally, it is imperative to enforce a mandatory password reset for all users who created accounts via express checkout on affected versions, as these passwords must be considered compromised regardless of whether an active attack was detected. Implementing strict input validation and output encoding practices across all plugins that handle user registration data will prevent similar vulnerabilities from arising in the future, ensuring compliance with industry best practices for secure software development lifecycle management.