Security update (November 2026): Stripe for WooCommerce 11.2.0 and 11.1.2 address security issues. This notice is about that security release, not the account cleanup described on this page. Advisory: https://developer.woocommerce.com/2026/11/11/stripe-gateway-security-update/
What should I do? Update to 11.2.0, or to 11.1.2 if your store needs to stay on 11.1.x. Both versions require WordPress 6.9 and WooCommerce 11.0. Check the installed version under Plugins → Installed Plugins, even if automatic updates are enabled.
Staying on 11.1.x: WordPress only offers 11.2.0. To install 11.1.2, download it from Previous Versions on the plugin’s Advanced View page at WordPress.org. Then upload it under Plugins → Add New Plugin → Upload Plugin.
Customer passwords (10.9.0): The advisory also covers a bug in version 10.9.0. It could save a customer’s new account password in plain text in the store’s order data. These passwords were visible to the store’s administrators and shop managers via the order details screen. They were also visible through other tools that expose order metadata, such as WP-CLI and the REST API. We’re unable to determine whether anyone viewed them.
The cleanup: Starting with 11.1.0, the plugin removes these passwords from order records after you update. If it removes any, it shows a notice in WordPress admin and emails the site administrator. The email subject is “[WooCommerce Stripe] Customer password data removed from order records”. The cleanup does not change or reset customers’ account passwords.
Next steps: If your store met the conditions in the advisory, check for copies of the stored passwords, even if you receive no email. Look in backups, order exports, and services that sync order data. Consider asking affected customers to reset their store password and change it anywhere else they used it.
In order to properly link local data to the data in Stripe’s systems, our Stripe extension stores various identifiers (for customers, cards, and so on) in your database. However, that data is specific to a single Stripe account.
For that reason, if you’re replacing a previous Stripe account with a new one, a database cleanup may be required. If you do not perform this cleanup, purchases could fail.
Before proceeding with the cleanup, however, please contact Stripe to check whether the existing data can be transferred over to your new account. If it can, this procedure may not be necessary.
NOTE: We are unable to provide support for customizations under our Support Policy. If you need assistance with custom code, we highly recommend Codeable or a Certified WooExpert.
Cleaning up the database on a single site
↑ Back to topThis is an example SQL query you might run on a single site installation of WordPress. Replace the wp_ value with your site’s database table prefix.
DELETE FROM
`wp_usermeta`
WHERE
meta_key IN (
'_stripe_customer_id', '_stripe_source_id',
'_stripe_card_id'
);
DELETE tokenmeta
FROM
`wp_woocommerce_payment_tokenmeta` tokenmeta
INNER JOIN `wp_woocommerce_payment_tokens` ON `wp_woocommerce_payment_tokens`.`token_id` = tokenmeta.`payment_token_id`
WHERE
`wp_woocommerce_payment_tokens`.`gateway_id` = 'stripe';
DELETE FROM
`wp_woocommerce_payment_tokens`
WHERE
gateway_id = 'stripe';Cleaning up the database on a multisite
↑ Back to topThis is an example SQL query you might run on a single site installation of WordPress. Replace the wp_ value with your site’s database table prefix.
This is an example SQL query you might run on a multisite installation of WordPress. Replace wp_999_ with the site prefix (or wp_ if cleaning up the database for the main site of the network, as it does not use a number in the prefix).
DELETE FROM
`wp_usermeta`
WHERE
meta_key IN (
'_stripe_customer_id', '_stripe_source_id',
'_stripe_card_id', 'wp_999__stripe_customer_id'
);
DELETE tokenmeta
FROM
`wp_999_woocommerce_payment_tokenmeta` tokenmeta
INNER JOIN `wp_999_woocommerce_payment_tokens` ON `wp_999_woocommerce_payment_tokens`.`token_id` = tokenmeta.`payment_token_id`
WHERE
`wp_999_woocommerce_payment_tokens`.`gateway_id` = 'stripe';
DELETE FROM
`wp_999_woocommerce_payment_tokens`
WHERE
gateway_id = 'stripe';
