{
 "id": "WPSEC-2026-3002",
 "url": "https://wpsec.com/vuln/WPSEC-2026-3002/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-3002/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-3002/index.md",
 "title": "WooCommerce Stripe Payment Gateway <= 11.1.1 - Authenticated (Shop Manager+) Sensitive Information Exposure via Payment Gateways REST API",
 "description": "The WooCommerce Stripe Payment Gateway plugin for WordPress is vulnerable to Sensitive Information Exposure via the WooCommerce payment_gateways REST API and the deprecated wc-admin/options REST route in versions 8.0.0 up to, and including, 11.1.1, due to the Stripe gateway's stored live and test secret keys and webhook signing secrets being returned unmasked in these responses. This makes it possible for authenticated attackers with Shop Manager-level access and above, as well as holders of read-only WooCommerce REST API keys, to retrieve the store's Stripe secret API keys and webhook secrets. These could be used to act on the merchant's Stripe account or to forge webhook notifications.",
 "plugin": {
  "slug": "woocommerce-gateway-stripe",
  "name": "WooCommerce Stripe Payment Gateway",
  "full_name": "WooCommerce Stripe Payment Gateway",
  "wordpress_org": "https://wordpress.org/plugins/woocommerce-gateway-stripe/",
  "advisories_url": "https://wpsec.com/vuln/plugin/woocommerce-gateway-stripe/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/woocommerce-gateway-stripe"
 },
 "type": "SENSITIVE DATA DISCLOSURE",
 "cwe": [
  "CWE-200"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 4.9,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": "8.0.0",
    "from_inclusive": true,
    "to": "11.1.2",
    "to_inclusive": false
   }
  ],
  "text": [
   "from 8.0.0 before 11.1.2"
  ]
 },
 "introduced_in": "8.0.0",
 "fixed_in": "11.1.2",
 "remediation": "Update to 11.1.2 or later.",
 "fix_released": "2026-11-11T19:06:22+00:00",
 "published": "2026-11-12T19:42:40+00:00",
 "updated": "2026-11-12T17:12:56.898164+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-3002/",
  "https://plugins.svn.wordpress.org/woocommerce-gateway-stripe/tags/11.1.2/",
  "https://wordpress.org/plugins/woocommerce-gateway-stripe/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/woocommerce-gateway-stripe",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "High",
  "affected_versions": "High",
  "as_of": "2026-11-12"
 }
}