CVE-2026-123145 WooCommerce Stripe Payment Gateway 10.9.0 - 11.0.1 - Customer Password Stored in Plaintext via Express Checkout
- Exploited in the wild
- Not known
- Fix
- None listed
What is CVE-2026-123145?
CVE-2026-123145 is a medium-severity vulnerability in Unknown WooCommerce Stripe Payment Gateway, published on 9 Nov 2026.
Official description
The WooCommerce Stripe Payment Gateway WordPress plugin before 11.1.0 does not exclude the account password from the checkout fields it saves to order metadata during express checkout, causing the password a customer chooses when creating an account at checkout to be stored in plaintext in the database, readable by anyone with access to order data or the database. Version 10.9.0 stored the passwords. Version 10.9.1 stopped new ones from being stored but left existing ones in place, and version 11.1.0 removes them on update. Passwords stored this way should be considered exposed.
Weakness: CWE-200
Which versions are affected by CVE-2026-123145?
How do I fix CVE-2026-123145?
No fix has been published for CVE-2026-123145 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-123145 being exploited?
There is no known exploitation of CVE-2026-123145 in the wild and no public exploit code.
Sources
Also known as GHSA-6hgw-83cf-5q96.