WooCommerce urges stores to update Stripe Gateway to 11.2.0 after security fixes

What WooCommerce fixed in the Stripe Gateway

On 11 November 2026, WooCommerce published an advisory on the WooCommerce developer blog asking anyone who runs, hosts or supports a store using the WooCommerce Stripe Gateway extension (also listed as Stripe for WooCommerce) to update it to version 11.2.0. Stores that need to remain on the 11.1.x branch should move to 11.1.2.

WooCommerce says the issues were found through Automattic’s own internal scanning and through reports made to it. The most significant could allow fraudulent purchases. It has no evidence that any were exploited, and the advisory does not describe the individual flaws in more detail.

The advisory also covers an earlier bug in version 10.9.0 that, in certain conditions, recorded the password a shopper chose when signing up, unencrypted, alongside their order. Version 10.9.1 stopped this, and from 11.1.0 the plugin removes those stored passwords in the background.

Which stores need to act

Any store taking payments through this extension should update. Fraudulent purchases are a direct cost to the store, and WooCommerce applied the fixes to both branches so merchants can keep their stores stable through the end-of-year period. Stores that do not use this extension are not affected by this advisory.

The password bug is narrower. It applied only to stores that ran 10.9.0, used classic checkout and showed Stripe’s Express Checkout buttons at that step, and had shoppers who created an account with a password and paid with Apple Pay or Google Pay. Those passwords were visible to administrators and shop managers, and through tools that expose order data such as the REST API. WooCommerce cannot tell whether anyone viewed them. The cleanup does not reset any customer’s password; if it removes stored data, it shows a notice in WordPress admin and emails the site administrator.

Versions 11.2.0 and 11.1.2 both depend on WordPress 6.9 and WooCommerce 11.0, so older sites may need those updated first.

What to check now

WooCommerce says to update now rather than wait for a routine update window.

• In WordPress admin, open Plugins, then Installed Plugins, and check the Stripe Gateway version, even if automatic updates are on or your host manages updates.
• Update to 11.2.0 or later. To stay on 11.1.x, download 11.1.2 from the Previous Versions section of the WordPress.org plugin directory and upload it over the current version.
• If your store met the 10.9.0 conditions, look through backups, exported order files and any service that copies your orders elsewhere for the stored passwords, and consider asking affected customers to reset theirs.
• If you manage several stores, check each one, including publicly accessible staging and development sites.
• If the update fails, contact WooCommerce Support with your installed version and the error shown.

If a host or developer looks after the store, confirm the installed version with them, and check whether your maintenance contract covers security updates like this one. Cognivise’s ongoing support and ownership service covers keeping stores patched when no one else clearly owns the job.