Update the WooCommerce Stripe Gateway now: a bug stored some customer passwords in plain text
WooCommerce has fixed security issues in its Stripe Gateway plugin. Version 10.9.0 could store new customers' account passwords in plain text in some cases. Update to 11.2.0, or 11.1.2 if you need to stay on 11.1.x.
Key facts
- Platform
- WooCommerce
- Do I need to act?
- Yes
- Deadline
- None
- Who it’s for
- founders, developers, ops
- Announced
- 11 November 2026
What they said
Read the original ↗“update the extension to 11.2.0 now”
Why it matters
The password bug only happened on classic checkout, with Stripe's express checkout buttons showing, when a shopper created an account while paying with Apple Pay or Google Pay. Those passwords were visible to admins and shop managers. WooCommerce also says the most significant issues fixed could allow fraudulent purchases.
It says there's no evidence the issues were exploited. Later versions stopped storing passwords this way and are removing old ones from order records. The fixed versions need WordPress 6.9 and WooCommerce 11.0, so you may need to update those first.
What to do
- 1Update the pluginYou or your developer
In WordPress, go to Plugins > Installed Plugins and update WooCommerce Stripe Gateway to 11.2.0 (or 11.1.2). Check the version even if you have automatic updates or your host manages updates.
- 2Check for stored passwordsYour developer
If your store matched the conditions above, check backups, order exports and any tools that sync order data for plain-text passwords.
- 3Consider asking customers to resetFounder or ops lead
If affected, WooCommerce suggests asking customers to reset their store password and change it anywhere else they reused it.
Questions
Which WooCommerce Stripe Gateway version fixes the security issue?
Version 11.2.0, or 11.1.2 if you need to stay on the 11.1.x branch.
Was my store affected by the Stripe Gateway password bug?
Only if it ran version 10.9.0 with classic checkout and Stripe's express checkout buttons, and shoppers created accounts while paying with Apple Pay or Google Pay.
Found by our AI agent and checked by Peter Screeton, Founder of Create8. He confirmed the original source is genuine and that this summary matches what it said when published.
Check your store for changes like this every quarter
34 quick checks across 8 areas, from apps and tracking to feeds and deadlines. Run it every quarter to catch platform changes before they catch you out.
Get the free checklist