What changed: Automattic released WooCommerce Stripe Gateway 11.2.0, plus 11.1.2 for stores staying on the 11.1.x branch, to fix security issues found through internal scanning and external disclosure; the most significant issue could allow fraudulent purchases, with no evidence of exploitation found. A separate bug in version 10.9.0 could store a new customer account password in plain text in order data when classic checkout displayed Stripe Express Checkout buttons and the shopper paid with Apple Pay or Google Pay while creating an account; starting with 11.1.0 the plugin removes any such stored passwords from orders in the background after updating.
Who is affected
All stores using the WooCommerce Stripe Gateway (Stripe for WooCommerce) plugin, plus the hosts, developers and agencies that manage them; the source does not state a geographic limitation.
What it means for your business
For businesses selling on WooCommerce with the Stripe payment plugin, this means that without the update they risk fraudulent purchases, and if they ran version 10.9.0, customer account passwords may have been visible in plain text in order records.
What to do
Store admins should check the installed WooCommerce Stripe Gateway version under Plugins > Installed Plugins, select 'Update Now' if 11.2.0 or later is offered, or download and upload 11.1.2 from the plugin directory's Previous Versions section if they must stay on the 11.1.x branch. Developers and agencies managing multiple sites should verify each site individually and keep a record of checked versions. If the update fails, contact WooCommerce Support with the installed version and any error message.
When it takes effect
The source gives no specific deadline; it asks stores to update now.
Source: https://developer.woocommerce.com/2026/11/11/stripe-gateway-security-update/
