If you run, maintain, host, or support a WooCommerce store that uses the WooCommerce Stripe Gateway (or Stripe for WooCommerce), update the extension to 11.2.0 now. If your store needs to stay on the 11.1.x branch, update to 11.1.2.
The update addresses security issues identified through Automattic’s proactive internal scanning and in response to issues disclosed to Automattic. We have no evidence that these issues have been exploited. The most significant issues could allow for fraudulent purchases. We have applied the fixes to both versions to support merchants preparing for the end of year period to maintain the stability of their stores.
Customer passwords stored in plain text (10.9.0)
A bug could save a customer’s new account password in plain text in the store’s order data when all of these conditions applied:
- The store was running WooCommerce Stripe Gateway 10.9.0.
- The store used classic checkout and displayed Stripe Express Checkout buttons on the checkout page.
- The shopper created an account with a password at checkout and paid with Apple Pay or Google Pay.
These passwords were visible to the store’s administrators and shop managers via the order details screen, and through other tools that expose order metadata, such as WP-CLI and the REST API. However, we’re unable to determine whether anyone viewed them. Version 10.9.1 stopped new passwords from being stored this way. Starting with 11.1.0, the plugin removes previously stored passwords from order records in the background after you update.
If the cleanup removes stored password data, the plugin displays a notice in WordPress admin and sends an email to the site administrator. The email includes an account count if any customers still use a password found in the removed data. The cleanup does not change or reset customers’ account passwords.
If your store met the conditions above, check backups, order exports, and services that sync order data for copies of the stored passwords, even if you receive no email. Consider asking affected customers to reset their store password and change it anywhere else they used it.
Note that Stripe for WooCommerce 11.1.2 and 11.2.0 require WordPress 6.9 and WooCommerce 11.0. You may need to update WordPress and/or WooCommerce for the updated versions to be compatible.
Check that your store has the update
In WordPress admin, go to Plugins → Installed Plugins and find WooCommerce Stripe Gateway. Check the installed version even if automatic updates are enabled or your host manages updates.
- For the standard update, select Update Now when WordPress offers 11.2.0 or a later version.
- If you need to stay on 11.1.x and are running an earlier version on that branch, follow these instructions:
- Open the Previous Versions section in the WordPress.org plugin directory.
- Select the 11.1.2 version from the dropdown and choose to download the version.
- Note that the plugin directory includes a warning on this page about older versions being insecure or unstable. This is a standard warning for this page, as many older, unsupported versions are listed.
- On your affected store, navigate to Plugins → Add New Plugin, and then click on the “Upload Plugin” button.
- Select the downloaded zip file for the plugin and accept the upload.
- You will see a notice that the plugin is already installed. Check that you are running a version older than 11.1.2, and then click on “Replace current with uploaded” to confirm the update.
After updating, return to Installed Plugins and verify the installed version.
Developers and agencies: Check each site
Verify the installed WooCommerce Stripe Gateway version on every affected site you manage, including publicly accessible staging and development sites. A completed update on one site does not confirm the status of another.
Keep a record of the versions you have checked so you can follow up on sites that still need attention. For stores managed by a hosting provider or another developer, confirm the installed version with that person or team.
Get help with the update
If the update is unavailable or fails to complete, contact WooCommerce Support. Include your installed Stripe extension version and any error shown during the update so the team can help you find the appropriate next step.
Leave a Reply