Security notice
Run a WooCommerce store with the Stripe Gateway? Update to 11.2.0 or 11.1.2 and check for stored customer passwords.
On November 11, 2026, WooCommerce said that if you run, maintain, host or support a WooCommerce store that uses the WooCommerce Stripe Gateway, also called Stripe for WooCommerce, you should update the extension to 11.2.0 now. If your store needs to stay on the 11.1.x branch, update to 11.1.2. WooCommerce says the most significant issues could allow fraudulent purchases, and that it has no evidence that these issues have been exploited. A separate bug in version 10.9.0 could save a customer's new account password in plain text in the store's order data when certain checkout conditions all applied. Versions 11.1.2 and 11.2.0 require WordPress 6.9 and WooCommerce 11.0. WooCommerce has not listed a CVE for this update. If you use this plugin, update and, if you ran 10.9.0, check backups and order exports for stored passwords. (WooCommerce, Nov 11)
What happened
- Security update published November 11. WooCommerce asked stores that use the WooCommerce Stripe Gateway, also called Stripe for WooCommerce, to update to 11.2.0, or to 11.1.2 if they need to stay on the 11.1.x branch. It says the update addresses security issues identified through Automattic's proactive internal scanning and in response to issues disclosed to Automattic. (WooCommerce, Nov 11)
- Fraudulent purchases. WooCommerce says the most significant issues could allow fraudulent purchases. It has not published a CVE or a more detailed public description of those issues. (WooCommerce, Nov 11)
- No evidence of exploitation, per WooCommerce. WooCommerce says, "We have no evidence that these issues have been exploited." (WooCommerce, Nov 11)
- Customer passwords stored in plain text in version 10.9.0. WooCommerce says a bug could save a customer's new account password in plain text in the store's order data when all of these conditions applied: the store was running WooCommerce Stripe Gateway 10.9.0; the store used classic checkout and displayed Stripe Express Checkout buttons on the checkout page; and the shopper created an account with a password at checkout and paid with Apple Pay or Google Pay. Those passwords were visible to the store's administrators and shop managers on the order details screen, and through other tools that expose order metadata, such as WP-CLI and the REST API. WooCommerce says it is unable to determine whether anyone viewed them. (WooCommerce, Nov 11)
- What later versions do. Version 10.9.1 stopped new passwords from being stored this way. Starting with 11.1.0, the plugin removes previously stored passwords from order records in the background after you update. If the cleanup removes stored password data, the plugin displays a notice in WordPress admin and sends an email to the site administrator. The email includes an account count if any customers still use a password found in the removed data. The cleanup does not change or reset customers' account passwords. (WooCommerce, Nov 11)
- Version requirements. WooCommerce says Stripe for WooCommerce 11.1.2 and 11.2.0 require WordPress 6.9 and WooCommerce 11.0. You may need to update WordPress and WooCommerce before the fixed versions will install. (WooCommerce, Nov 11)
Who should worry
- You run, maintain, host or support a WooCommerce store that uses the WooCommerce Stripe Gateway, also called Stripe for WooCommerce.
- Your store ran version 10.9.0, used classic checkout, showed Stripe Express Checkout buttons on the checkout page, and had shoppers create an account with a password at checkout while paying with Apple Pay or Google Pay.
- You keep backups, order exports or synced copies of order data from a store that met those conditions.
If you do not use this plugin, this notice does not apply to you.
What to do now
This follows WooCommerce's advice.
- Update to 11.2.0, or to 11.1.2 if you need to stay on the 11.1.x branch. In WordPress admin, go to Plugins, Installed Plugins, and find WooCommerce Stripe Gateway. Check the installed version even if automatic updates are enabled or your host manages updates. You may need to update WordPress to 6.9 and WooCommerce to 11.0 first, because 11.1.2 and 11.2.0 require those versions. (WooCommerce, Nov 11)
- For the standard update, select Update Now when WordPress offers 11.2.0 or a later version. After updating, return to Installed Plugins and confirm the installed version. (WooCommerce, Nov 11)
- If you need to stay on 11.1.x and are running an earlier version on that branch, WooCommerce says to download 11.1.2 from the Previous Versions section in the WordPress.org plugin directory, then use Plugins, Add New Plugin, Upload Plugin to replace the copy on your store. The directory shows a standard warning that older versions can be insecure; WooCommerce says that warning appears because many older, unsupported versions are listed there. Check that you are running a version older than 11.1.2 before you choose to replace the current plugin with the uploaded file, then confirm the installed version. (WooCommerce, Nov 11)
- If your store met the 10.9.0 conditions above, check for stored passwords. Check backups, order exports and services that sync order data for copies of the stored passwords, even if you receive no email after the cleanup. Consider asking affected customers to reset their store password and change it anywhere else they used it. (WooCommerce, Nov 11)
- If you manage more than one site, verify the installed version on every affected site, including publicly accessible staging and development sites. A completed update on one site does not confirm the status of another. For stores managed by a host or another developer, confirm the installed version with that person or team. (WooCommerce, Nov 11)
- If the update is unavailable or fails, contact WooCommerce Support. Include your installed Stripe extension version and any error shown during the update. (WooCommerce, Nov 11)
What to send your developer, agency or host
WooCommerce said on November 11, 2026 that stores using the WooCommerce Stripe Gateway, also called Stripe for WooCommerce, should update to 11.2.0, or to 11.1.2 if they need to stay on the 11.1.x branch. The most significant issues could allow fraudulent purchases. A separate bug in 10.9.0 could save a new customer password in plain text in order data when classic checkout, Stripe Express Checkout buttons, and Apple Pay or Google Pay account creation at checkout all applied. Versions 11.1.2 and 11.2.0 require WordPress 6.9 and WooCommerce 11.0. Please check which version we are running, update us to 11.2.0 or 11.1.2, and tell us if we need to update WordPress or WooCommerce first. If we ran 10.9.0 under those conditions, please check backups, order exports and any service that syncs order data for stored passwords, and tell us whether we should ask affected customers to reset their passwords. Please confirm the version you left us on. Source: WooCommerce, Nov 11.
Common questions
Has my site been hacked?
This notice does not mean your site has been hacked. It is about a security update for the WooCommerce Stripe Gateway plugin. WooCommerce says it has no evidence that these issues have been exploited. If you ran 10.9.0 under the conditions above, check for stored passwords as described in What to do now. (WooCommerce, Nov 11)
Can EverThread tell me if I am affected?
No. EverThread does not test for this. We check your home page from the outside, the way a browser sees it. We cannot see which plugins your store runs, which versions they are on, or your order data, and we cannot tell you whether customer passwords were stored.
Is there a CVE?
WooCommerce has not listed a CVE in this advisory. The update is still the step to take if you use the plugin. (WooCommerce, Nov 11)
Will the update reset my customers' passwords?
No. WooCommerce says the cleanup that starts with 11.1.0 removes previously stored passwords from order records in the background, and that it does not change or reset customers' account passwords. If the cleanup removes stored password data, the plugin shows a notice in WordPress admin and emails the site administrator, including an account count if any customers still use a password found in the removed data. WooCommerce still asks you to consider asking affected customers to reset their store password and change it anywhere else they used it. (WooCommerce, Nov 11)
Where can I follow official updates?
WooCommerce's Stripe Gateway security update of November 11, 2026. All current notices are on our notices page.
Security alerts by email
Hear about the next one first.
When a flaw puts websites at risk, we send one email: what happened, who it affects and what to do. It's free, whether or not you use EverThread.
Sources
- WooCommerce: Security fix for WooCommerce Stripe Gateway: update to 11.2.0 or 11.1.2, November 11, 2026, checked November 12, 2026