Sensitive Data Exposure in WooCommerce Stripe Payment Gateway Plugin by WordPress
CVE-2026-123145

Currently unrated

Key Information:

Vendor

WordPress
Status
WooCommerce Stripe Payment Gateway
Vendor
CVE Published:
9 November 2026

Badges

👾 Exploit Exists🟡 Public PoC

What is CVE-2026-123145?

The WooCommerce Stripe Payment Gateway plugin for WordPress prior to version 11.1.0 inadvertently stores customer account passwords in plaintext within order metadata during express checkout. This flaw allows anyone with access to the order data or the database to view sensitive information. While version 10.9.1 prevented new passwords from being saved in this manner, it did not address previously stored passwords, leaving them vulnerable until the release of version 11.1.0, which effectively removes these sensitive entries upon update.

Affected Version(s)

WooCommerce Stripe Payment Gateway 10.9.0 < 11.1.0

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2026-123145 - Proof of Concept

References

https://wpscan.com/vulnerability/9a9ff174-9bb4-4944-b95e-...
exploitvdb-entrytechnical-description

Timeline

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

Credit

Francesco Carlucci
WPScan
.