WooCommerce Stripe Gateway security update: move to 11.2.0 or 11.1.2 and check for stored passwords

What the Stripe Gateway security update fixes

WooCommerce Stripe Gateway, also listed as Stripe for WooCommerce, is the plugin that connects your shop to Stripe so customers can pay by card, Apple Pay or Google Pay. According to the WooCommerce security advisory, the new releases fix issues found through Automattic's own internal scanning and issues reported to the company.

Two separate concerns sit inside the announcement. The first affects any store on a version older than 11.2.0, or older than 11.1.2 on the 11.1.x branch, and involves the flaws Automattic says make fraudulent purchases possible. The second is a narrower bug in version 10.9.0 that saved some customer passwords in plain text. Both are covered below, starting with the update every Stripe store needs.

Choosing between 11.2.0 and 11.1.2

For most stores the answer is 11.2.0, the standard update WordPress offers on the plugins screen. Automattic also released 11.1.2 for stores that need to stay on the 11.1.x branch, applying the fixes to both versions to support merchants preparing for the end-of-year period and to keep their stores stable.

Both versions require WordPress 6.9 and WooCommerce 11.0. If your site runs older versions of either, WordPress will not treat the Stripe update as compatible until you update them first. Take a fresh backup before updating WordPress core and WooCommerce, because those larger updates carry more risk of a conflict than a single plugin patch.

Check and apply the standard update

Automatic updates and host-managed updates are not a confirmation. The advisory specifically tells owners to check the installed version even when either is switched on, and the check takes under a minute.

1. In WordPress admin, go to Plugins > Installed Plugins and find WooCommerce Stripe Gateway.
2. Read the version number shown under the plugin name.
3. If WordPress offers 11.2.0 or later, select Update Now.
4. Return to Plugins > Installed Plugins and confirm the new version number appears.

Staying on 11.1.x: the manual upload route

Stores that need to remain on 11.1.x and are running an earlier 11.1 release can install 11.1.2 by hand. The version is available from the Previous Versions section of the WordPress.org plugin directory. That page warns that older plugin versions are not guaranteed to be secure or stable. The advisory describes this as a standard warning for the page, because many older, unsupported versions are listed there, so it is not a sign that 11.1.2 is unsafe.

1. Open the Previous Versions section, select 11.1.2 from the dropdown and download the zip file.
2. On the store, go to Plugins > Add New Plugin and click Upload Plugin.
3. Choose the downloaded zip and upload it.
4. When WordPress reports the plugin is already installed, check your current version is older than 11.1.2, then click Replace current with uploaded.
5. Go back to Installed Plugins and confirm the version now reads 11.1.2.

The 10.9.0 plain-text password bug

Separately from the main fixes, version 10.9.0 had a bug that saved a shopper's new account password in plain text inside the order data. Plain text means the password was readable as typed, rather than scrambled the way WordPress normally stores passwords. All of these conditions had to apply at once:

Anyone with administrator or shop manager access could see those passwords on the order details screen, and so could tools that expose order metadata, such as WP-CLI and the REST API. Automattic says it cannot determine whether anyone viewed them. Version 10.9.1 stopped new passwords being saved this way, and from 11.1.0 onwards the plugin removes previously stored passwords from order records in the background after you update.

• The store was running WooCommerce Stripe Gateway 10.9.0.
• The store used classic checkout and showed Stripe Express Checkout buttons on the checkout page.
• The shopper created an account with a password at checkout.
• The shopper paid with Apple Pay or Google Pay.

Where copies of stored passwords can remain

When the background cleanup removes stored password data, the plugin shows a notice in WordPress admin and emails the site administrator. If any customers still use a password found in the removed data, the email includes a count of those accounts. The cleanup does not change or reset anyone's password, so those customers are still signing in with a password that sat in readable form.

Removing the data from live orders also leaves earlier copies untouched. If your store met the conditions above, check backups, order exports and any service that syncs order data, such as accounting or fulfilment tools, for copies of the passwords. Do this even if no cleanup email arrived. A backup taken before the cleanup holds whatever was in the order data at the time, so think carefully before restoring one, and read our guide to restoring WooCommerce without losing orders if a rollback is on the table.

Automattic suggests considering asking affected customers to reset their store password and change it anywhere else they used it. A short, plain message explaining what happened and what to do will serve customers better than a vague security notice.

Agencies and multi-site owners: check every install

A completed update on one site tells you nothing about the next. The advisory asks developers and agencies to verify the installed version on every site they manage, including publicly accessible staging and development copies, which are easy to forget because nobody takes orders through them.

Keep a simple record of each site, the version you found and the date you checked, so you can follow up on anything still outstanding. Where a host or another developer manages the store, ask them to confirm the installed version rather than assuming it has been done. For background on how WooCommerce now ships security fixes, see our post on dedicated patch releases and required installs.

Confirming the update worked, and what that proves

The version number on the Installed Plugins screen is your evidence that the fix is in place. A successful test order is a separate observation: it shows checkout and Stripe payments still work after the update, but it does not prove the security issues are closed. You need both checks, for different reasons.

After updating, place a low-value test order with a card and, if you offer them, the Express Checkout buttons, then confirm the order appears with the right status and the payment shows in Stripe. If payments fail after the update, our guide to fixing WooCommerce checkout problems covers caching, loading errors and plugin conflicts. When the update itself is unavailable or fails, contact WooCommerce Support with your installed Stripe version and any error message. If you would rather hand it over, BugShield can investigate a Stripe payment failure at a fixed price.