Update WooCommerce Stripe Gateway to 11.2.0 or 11.1.2

WooCommerce has released a security fix for its Stripe Gateway plugin, which many independent shops use to take card payments through Stripe. In an advisory published on 11 November 2026, WooCommerce says the most serious issues “could allow for fraudulent purchases”. It asks stores to update to version 11.2.0, or to 11.1.2 if they need to stay on the 11.1.x versions. WooCommerce says there is no evidence any of the issues have been exploited, but the fix only protects your shop once the plugin is updated.

Which plugin this affects

This is a separate plugin from WooCommerce itself and from WooPayments. The updates we covered on 6 November in WooCommerce 11.2.2 and WooPayments security updates explained do not include it. Updating WooCommerce does not update Stripe Gateway.

The plugin goes by three names. Your WordPress plugin list shows “WooCommerce Stripe Gateway”. The WordPress.org directory calls it “WooCommerce Stripe Payment Gateway”, and WooCommerce’s own marketplace calls it “Stripe for WooCommerce”. They are all the same plugin, which WordPress.org lists as having more than 700,000 active installations.

What WooCommerce has said

The problems were found through internal scanning by Automattic, the company that owns WooCommerce, and through reports from others. WooCommerce has not published technical details of the fraudulent-purchase issues. There is no public CVE (a public vulnerability ID) or severity score for them yet.

WooCommerce fixed both the 11.2 and 11.1 versions. That gives shops that would rather avoid a larger update in the run-up to the end of the year a way to stay on 11.1.x and still be protected. Both fixed versions need WordPress 6.9 and WooCommerce 11.0, so some stores will need to update those first.

The 11.2.0 release notes, dated 10 November, do not say which changes are security fixes. Several entries cover how payments are matched to orders, checking payment details before they are sent to Stripe, and masking Stripe secret keys in the site’s REST API (the way other software reads data from your site). That is our reading of the changelog, not WooCommerce’s description.

Version 11.2.0 also fixes some problems shop owners would notice:

• Payments that succeed on orders that were already cancelled are now refunded or voided.
• Double charges are prevented when a checkout is resubmitted, or when the same cart is paid for in two browser tabs.
• A staging or cloned copy of your site can no longer delete the live site’s Stripe webhooks, the notifications Stripe sends your shop to confirm payments.

A separate issue with stored passwords

The advisory also covers an earlier bug. Version 10.9.0 could save a customer’s new account password in plain text in the store’s order records. This only happened when all three of these were true:

• the store ran version 10.9.0;
• it used the classic checkout with Stripe Express Checkout buttons on the checkout page;
• the shopper created an account with a password at checkout and paid with Apple Pay or Google Pay.

Store administrators and shop managers could see those passwords on the order details screen. Other tools that read order data could show them too, including WP-CLI (a command-line tool) and the REST API. WooCommerce says it cannot tell whether anyone actually viewed them.

WPScan, a database of WordPress vulnerabilities, is firmer: “Passwords stored this way should be considered exposed.” It lists the issue as CVE-2026-123145 and rates it medium (4.4 out of 10), because someone would need high-level access to the site to see the data. WPScan lists versions 10.9.0 to 11.0.1 as affected, because the stored passwords stayed in the database until 11.1.0. It plans to publish technical details on 20 November.

Version 10.9.1 stopped new passwords being stored. From 11.1.0, the plugin removes any previously stored passwords from order records in the background. If it finds any, you will see a notice in the WordPress dashboard and the site administrator will get an email. The email gives a count of customers who still use a password found in the removed data. The cleanup does not reset anyone’s password.

Most shops will not have met all three conditions. If yours did, WooCommerce suggests checking backups, order exports and any services that sync your order data for copies of the passwords, even if no email arrives. It also suggests asking affected customers to reset their password on your store and to change it anywhere else they used it.

What is not yet known

• WooCommerce has not said which versions the fraudulent-purchase issues affect or when they were introduced. It treats anything below 11.2.0, or below 11.1.2 on the 11.1.x versions, as needing the update.
• We have not found independent write-ups from security firms at the time of writing.
• WooCommerce has not said what stores that cannot yet run WordPress 6.9 and WooCommerce 11.0 should do, beyond contacting its support team.

What you should do

If we look after your website

Keeping payment plugins up to date is part of our care plans, so there is no need to upload anything yourself. If your shop offered Apple Pay or Google Pay with account creation at checkout, or you received the password cleanup email, let us know and we can work through the follow-up steps with you.

If you manage it yourself

1. In the WordPress dashboard, go to Plugins → Installed Plugins and check the version of WooCommerce Stripe Gateway. Do this even if automatic updates are switched on or your host manages updates.
2. Choose Update Now when 11.2.0 or later is offered. If it is not offered, check that you are on WordPress 6.9 and WooCommerce 11.0 or later, and update those first.
3. To stay on 11.1.x instead, download 11.1.2 from the “Previous Versions” section of the plugin’s WordPress.org page. Upload it through Plugins → Add New Plugin → Upload Plugin, choose “Replace current with uploaded”, then check the version. WooCommerce says the warning on WordPress.org that older versions may be insecure is a standard message on that page.
4. Take a backup before updating, and check your checkout still takes payments afterwards.
5. Check any staging or development copies of your site too, especially ones that can be reached publicly.
6. If your store met the password conditions above, follow WooCommerce’s steps on backups, exports and customer password resets.
7. If the update fails, contact WooCommerce Support with your installed version and any error message.

If you are wondering why updates like this keep arriving, our post on why WooCommerce keeps releasing security updates explains what is behind them and how to keep on top of them.