Information disclosure in Woocommerce Stripe Payment Gateway

CVE-2026-123145

The WooCommerce Stripe Payment Gateway WordPress plugin before 11.1.0 does not exclude the account password from the checkout fields it saves to order metadata during express checkout, causing the password a customer chooses when creating an account at checkout to be stored in plaintext in the database, readable by anyone with access to order data or the database. Version 10.9.0 stored the passwords. Version 10.9.1 stopped new ones from being stored but left existing ones in place, and version 11.1.0 removes them on update. Passwords stored this way should be considered exposed.

Vulnerability class: Information Disclosure

Published · last modified .

CVSS v3 metric

CVSS v3 base score 4.4 (Medium). Vector: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:N.

EPSS exploit prediction

No EPSS score from FIRST.org yet. New CVEs usually get one within a few days; no score means no signal yet, not low risk. How EPSS works.

Affected products

  • Woocommerce Stripe Payment Gateway

Weakness classification (CWE)

References

Frequently asked questions

What is CVE-2026-123145?
CVE-2026-123145 is a medium-severity vulnerability in Woocommerce Stripe Payment Gateway, classified under Information Disclosure. CVSS score: 4.4/10. Published 2026-11-09.
How severe is CVE-2026-123145?
Medium severity. CVSS v3 base score is 4.4 out of 10.