{
 "id": "WPSEC-2026-2965",
 "url": "https://wpsec.com/vuln/WPSEC-2026-2965/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-2965/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-2965/index.md",
 "title": "WooCommerce Stripe Payment Gateway < 11.2.0 - Unauthenticated Sensitive Information Exposure via Pay for Order Page",
 "description": "The WooCommerce Stripe Payment Gateway plugin for WordPress is vulnerable to Sensitive Information Exposure via the Pay for Order page in all versions up to, and including, 11.1.2, due to the plugin adding the order's billing details (name, email, phone and address) to the page's localized script data whenever a valid order key is present, even while WooCommerce is still showing its guest email verification form. This makes it possible for unauthenticated attackers who hold an order-pay link to read the billing details of a guest order without proving ownership of the billing email.",
 "plugin": {
  "slug": "woocommerce-gateway-stripe",
  "name": "WooCommerce Stripe Payment Gateway",
  "full_name": "WooCommerce Stripe Payment Gateway",
  "wordpress_org": "https://wordpress.org/plugins/woocommerce-gateway-stripe/",
  "advisories_url": "https://wpsec.com/vuln/plugin/woocommerce-gateway-stripe/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/woocommerce-gateway-stripe"
 },
 "type": "SENSITIVE DATA DISCLOSURE",
 "cwe": [
  "CWE-200"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 3.7,
  "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N",
  "severity": "Low"
 },
 "affected": {
  "ranges": [
   {
    "from": null,
    "from_inclusive": true,
    "to": "11.2.0",
    "to_inclusive": false
   }
  ],
  "text": [
   "all versions before 11.2.0"
  ]
 },
 "introduced_in": null,
 "fixed_in": "11.2.0",
 "remediation": "Update to 11.2.0 or later.",
 "fix_released": "2026-11-10T11:39:39+00:00",
 "published": "2026-11-12T17:52:14+00:00",
 "updated": "2026-11-12T17:13:53.909676+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-2965/",
  "https://plugins.svn.wordpress.org/woocommerce-gateway-stripe/tags/11.2.0/",
  "https://wordpress.org/plugins/woocommerce-gateway-stripe/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/woocommerce-gateway-stripe",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "High",
  "affected_versions": "High",
  "as_of": "2026-11-12"
 }
}