Bureau of Enchantments
WooCommerce Stripe Gateway 11.2.0 and 11.1.2 Issued as Urgent Security Decree
WooCommerce Stripe Gateway stores must update to 11.2.0 or 11.1.2 now, as the fixes close security issues, the worst of which could allow fraudulent purchases.
Wednesday, 11 November 2026 · 2 min read
Behold, a decree from the WooCommerce Developer Blog: every store running the WooCommerce Stripe Gateway, also known as Stripe for WooCommerce, should update the extension to 11.2.0 now. Stores that must remain on the 11.1.x branch are told to install 11.1.2 instead. The release fixes security issues that Automattic found through its own proactive internal scanning or that were disclosed to it, and the most significant of them could allow for fraudulent purchases. Automattic states it has no evidence that these issues have been exploited. The fixes were applied to both versions to help merchants preparing for the end of year period keep their stores stable. Among the more arcane revelations is a bug in version 10.9.0 that could save a customer's new account password in plain text, meaning readable and unscrambled, within the store's order data. This befell stores using classic checkout with Stripe Express Checkout buttons on the checkout page, when a shopper created an account at checkout and paid with Apple Pay or Google Pay. Such passwords were visible to administrators and shop managers through the order details screen and through other tools that expose order data, such as WP-CLI and the REST API, though the company says it is unable to determine whether anyone viewed them. Version 10.9.1 stopped new passwords from being stored this way, and from 11.1.0 the plugin removes previously stored passwords from order records in the background after the update. If that cleanup finds such data, the plugin displays a notice in WordPress admin and emails the site administrator, without changing or resetting any customer passwords. Affected stores are urged to check backups, order exports and services that sync order data, and to consider asking customers to reset their passwords. The wondrous new versions require WordPress 6.9 and WooCommerce 11.0, so some stores may need to update those first. Developers and agencies are advised to verify the installed version on every site they manage, including publicly accessible staging and development sites, and to contact WooCommerce Support if the update is unavailable or fails.
Source: developer.woocommerce.com