Threats tagged 'ghsa-6hgw-83cf-5q96'

The WooCommerce Stripe Payment Gateway WordPress plugin versions before 11.1.0 improperly stored customer account passwords in plaintext within order metadata during express checkout. This exposure affects passwords chosen by customers when creating accounts at checkout, making them accessible to anyone with database or order data access. Version 10.9.0 stored passwords, 10.9.1 stopped storing new passwords but retained existing ones, and 11.1.0 removes stored passwords on update. Passwords stored in this manner should be considered compromised.