CVE-2026-123145

{
  "etk_id": "ETK-2026-3932",
  "cve_id": "CVE-2026-123145",
  "display_id": "CVE-2026-123145",
  "ghsa_id": "GHSA-6hgw-83cf-5q96",
  "euvd_id": "EUVD-2026-119834",
  "status": "published",
  "anchor_state": "anchored",
  "title": "Plaintext password storage in WooCommerce Stripe Payment Gateway",
  "summary": "WooCommerce Stripe Payment Gateway releases before 11.1.0 can retain passwords chosen during express checkout account creation as unencrypted order metadata. Anyone who can access the affected order records or underlying database may be able to obtain those passwords; exposure requires that an account was created through the affected checkout flow.",
  "mitigation": "Upgrade WooCommerce Stripe Payment Gateway to version 11.1.0, which removes the retained password data during update. Reset passwords for accounts that may have been created through the affected checkout flow.",
  "vendor": null,
  "product": "WooCommerce Stripe Payment Gateway",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= 10.9.0, < 11.1.0"
      ],
      "ecosystem": null,
      "fixed_versions": [
        "11.1.0"
      ],
      "package_name": "WooCommerce Stripe Payment Gateway",
      "purl": null
    }
  ],
  "cwes": [
    200
  ],
  "cvss_score": 4.4,
  "cvss_src": "nvd",
  "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:N",
  "epss_score": 0.0014,
  "epss_percentile": 0.0335,
  "epss_asof": "2026-11-09",
  "automation": "deterministic",
  "check": true,
  "check_confidence_basis": "differential",
  "exploit": false,
  "pipeline_minutes": 37.127433366666665,
  "t0_at": "2026-11-09T06:00:28.964000+00:00",
  "signals": {
    "check": {
      "at": "2026-11-09T07:39:43.300048+00:00",
      "days": 0.06891592648148148,
      "is_lower_bound": false,
      "measured_at": "2026-11-09T06:00:28.964000+00:00",
      "url": null
    },
    "trigger_signal": {
      "at": "2026-11-09T06:00:28.964000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-11-09T06:00:28.964000+00:00",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-123145"
    }
  }
}