WooCommerce Stripe Gateway Gets Security Fixes in 11.2.0 and 11.1.2

Automattic has released security updates for the WooCommerce Stripe Gateway extension, also sold as Stripe for WooCommerce. Store owners should update to version 11.2.0, or to 11.1.2 if their store must stay on the 11.1.x branch. The fixes address security issues found through Automattic’s proactive internal scanning and issues disclosed to the company. Automattic says it has no evidence that these issues have been exploited, but the most significant ones could allow fraudulent purchases.

The update also addresses a separate bug in version 10.9.0. Under specific conditions, the plugin saved a new customer’s account password in plain text in the store’s order data. Those conditions were a classic checkout that displayed Stripe Express Checkout buttons, plus a shopper who created an account with a password at checkout and paid with Apple Pay or Google Pay. Administrators, shop managers, and tools such as WP-CLI and the REST API could view these passwords. Automattic cannot determine whether anyone viewed them. Version 10.9.1 stopped new passwords from being stored this way. Starting with 11.1.0, the plugin removes previously stored passwords from order records after an update.

Why it matters

Fraudulent purchases cost merchants money and damage customer trust. Exposed passwords can also reach beyond a single store if shoppers reused them elsewhere. Automattic applied the fixes to both branches so merchants can keep their stores stable ahead of the year-end period.

What to do

Update to 11.2.0, or to 11.1.2 if you must stay on the 11.1.x branch, and confirm your site meets the WordPress 6.9 and WooCommerce requirements. If your store matched the conditions above, check backups, order exports, and sync services for stored passwords, even if you received no email, and consider asking affected customers to reset their passwords. Confirm any remaining compatibility details on the vendor’s site.