# CVE-2026-123145: WooCommerce Stripe Payment Gateway 10.9.0 - 11.0.1 - Customer Password Stored in Plaintext via Express Checkout

Status: published. Published: 2026-11-09. Updated: 2026-11-09.

The WooCommerce Stripe Payment Gateway WordPress plugin before 11.1.0 does not exclude the account password from the checkout fields it saves to order metadata during express checkout, causing the password a customer chooses when creating an account at checkout to be stored in plaintext in the database, readable by anyone with access to order data or the database. Version 10.9.0 stored the passwords. Version 10.9.1 stopped new ones from being stored but left existing ones in place, and version 11.1.0 removes them on update. Passwords stored this way should be considered exposed.

## Remediation

No remediation reported in collected sources

## Affected products and versions

- Unknown / WooCommerce Stripe Payment Gateway: ≥ 10.9.0; < 11.1.0 (affected, semver). Source: CNA: WPScan

## Severity and prioritization

- CISA KEV: No listing in collected sources

- EPSS: Not available

- SSVC: Not available

- Weaknesses: CWE-200

## Exploit evidence

- exploit: https://wpscan.com/vulnerability/9a9ff174-9bb4-4944-b95e-d389fd6fe940/ (CNA: WPScan)

## References

- https://wpscan.com/vulnerability/9a9ff174-9bb4-4944-b95e-d389fd6fe940/ (CNA: WPScan; exploit, vdb-entry, technical-description)

## Provenance

- CNA: WPScan: https://www.cve.org/CVERecord?id=CVE-2026-123145; retrieved 2026-11-09; source updated 2026-11-09

Revision: af1595d57f96cda30a3c2fe73802d48572b11b0f96aa48689887c0ddc7c8a460

Canonical: https://y2.dev/cve/CVE-2026-123145

## Agent and API access

Public CVE pages, Markdown, and JSON are free to read without an account or API key.

- Public catalog: https://y2.dev/cve/index.json. Follow nextCursor with the same search, filters, sort, and limit (1–100). A null cursor marks the end.

- WebMCP: search_cve_disclosures, get_cve_disclosure, get_cve_page_markdown, get_y2_cve_access. Available in compatible browsers.

- Cyber API: https://api.y2.dev/api/v2/cyber/cves and https://api.y2.dev/api/v2/cyber/cves/{cveId}.

- Y2 Pro or Elite: create a workspace API key with the intel:cyber scope and send Authorization: Bearer <Y2_API_KEY>. Setup: https://y2.dev/docs/api/create-key.

- x402: Pay per request without an account or API key. Omit Authorization, read the HTTP 402 PAYMENT-REQUIRED challenge, validate its current requirements, and retry with PAYMENT-SIGNATURE through an authorized payment client. These browser tools never make payments. Guide: https://y2.dev/docs/api/x402.

- OpenAPI: https://y2.dev/api/openapi.yaml. Agent access metadata: https://y2.dev/cve/agent.json.

Collected public records only. Check source status for coverage and freshness.