WooCommerce Stripe Gateway security fix: update to 11.2.0

If your WooCommerce shop takes payments with the Stripe Gateway plugin, update it to 11.2.0 today, or to 11.1.2 if you stay on the 11.1 line. WooCommerce says the worst of the fixed holes could allow fraudulent purchases, and it has seen no sign of them being used. Shops that once ran 10.9.0 should also check for saved customer passwords.

What did WooCommerce fix?

WooCommerce published the advisory on 11 November 2026 (Malaysia time 12 November). The problems were found by Automattic's own scans and from outside reports. WooCommerce does not list each one, but says the most serious could allow fraudulent purchases. The fixes went into two versions so that shops which want to stay on 11.1 before the year end sales can still get them.

One bug in version 10.9.0 saved a customer's new account password as plain text in the order data. It only happened when all three of these were true:

• the shop ran Stripe Gateway 10.9.0;
• it used the classic checkout page with the Stripe Express Checkout buttons shown;
• a new customer set a password while signing up during checkout, then paid by Apple Pay or Google Pay.

Shop admins and shop managers could see those passwords in the order details, and so could tools that read order data, such as the REST API. WooCommerce cannot tell whether anyone looked. Version 10.9.1 stopped it, and from 11.1.0 the plugin deletes the saved passwords from old orders in the background after the update. If it finds and removes any, it shows a notice in WordPress admin and emails the site administrator, with a count of accounts that still use one of those passwords. The cleanup does not reset anyone's password.

What to do

1. Back up the shop and its database first, or ask your host or web designer to do it.
2. The new versions need WordPress 6.9 and WooCommerce 11.0. Update those first if your shop is older.
3. In WordPress, go to Plugins, then Installed Plugins, and find WooCommerce Stripe Gateway. Click Update Now when 11.2.0 or newer is offered. Check the version number afterwards, even if automatic updates are on.
4. If you need to stay on 11.1, WooCommerce explains how to install 11.1.2 from the plugin's Previous Versions section on WordPress.org. Ask your developer to do this if you are not sure.
5. Place a small test order with a card after the update to make sure checkout still works.
6. If your shop ever ran 10.9.0 with Express Checkout buttons on the classic checkout, look for copies of the old order data in backups, order exports and any service that syncs your orders (accounting, delivery or marketing tools). Do this even if no email arrives. WooCommerce suggests asking the affected customers to change their shop password, and to change it on any other site where they used the same one.
7. Update staging or test copies of the shop too.

If an outside web designer looks after your shop, forward this post to them and ask them to tell you the installed version once it is done. If the update fails, WooCommerce asks you to contact its support with your Stripe plugin version and the error shown.

Our earlier post on WooCommerce security updates explains why these patch releases now come more often.

How SyncTech can help

Our website care plan for WooCommerce shops keeps plugins updated and tests the checkout after each update.

Source and credit

We are sharing this news from WooCommerce. This summary is written by Synctech in our own words.

• Security fix for WooCommerce Stripe Gateway: update to 11.2.0 or 11.1.2, WooCommerce Developer Blog, 11 November 2026: https://developer.woocommerce.com/2026/11/11/stripe-gateway-security-update/ Retrieved 12 Nov 2026. WooCommerce, Stripe, Apple Pay and Google Pay are trademarks of their owners. Synctech is not connected with them. This is general information, not legal, tax or financial advice. If anything here is wrong, email support@synctech.com.my and we will correct it.