CVE-2026-123145
4.4 MEDIUMPublished 2026-11-09 · Updated 2026-11-10
AI analysis for this CVE has not been generated yet. Raw NVD data is shown below.
NVD description
The WooCommerce Stripe Payment Gateway WordPress plugin before 11.1.0 does not exclude the account password from the checkout fields it saves to order metadata during express checkout, causing the password a customer chooses when creating an account at checkout to be stored in plaintext in the database, readable by anyone with access to order data or the database. Version 10.9.0 stored the passwords. Version 10.9.1 stopped new ones from being stored but left existing ones in place, and version 11.1.0 removes them on update. Passwords stored this way should be considered exposed.
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:N
Weaknesses
CWE-200
All references
Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.
Related CVEs
- MEDIUMCVE-2013-10077PoC
- MEDIUMCVE-2025-13647
- MEDIUMCVE-2025-71455
- MEDIUMCVE-2026-100149PoC
- HIGHCVE-2026-100241
- HIGHCVE-2026-100244
- MEDIUMCVE-2026-100286
- UNSCOREDCVE-2026-100377
Related by shared AI tags and CWE weakness class. Browse the full archive.