CVE-2023-52143 is a high severity (7.5 CVSS) sensitive information exposure in the WP Stripe Checkout plugin for WordPress, in versions through 1.2.2.37. It can be triggered without logging in. Patchstack lists 1.2.2.38 as the patched release, so update to 1.2.2.38 or later.
What's affected
The NVD record covers WP Stripe Checkout from Naa986, versions through 1.2.2.37, and describes exposure of sensitive information to an unauthorized actor. The weakness is CWE-532 (Insertion of Sensitive Information into Log File). Patchstack describes the exposure through a log file, according to the title of the Patchstack advisory.
The record does not say what data is exposed, and we will not guess. The vector rates confidentiality impact as high, with no privileges and no user interaction needed.
How to check if you're exposed
On a site you manage, list installed plugins and their versions with wp-cli:
wp plugin list --fields=name,version,update_version,status
wp plugin get wp-stripe-checkout --field=version
The slug wp-stripe-checkout comes from the Patchstack advisory address, so confirm it matches the folder under wp-content/plugins on your site. A version of 1.2.2.37 or lower is in the affected range. The Plugins screen in the dashboard shows the same version number.
Then look for log files the plugin writes inside the web root. If you can fetch a plugin log file in a browser without logging in, so can anyone else. Check your own site only, and do not post what you find.
What to do now
- Back up the site.
- Update WP Stripe Checkout to 1.2.2.38 or later, from the dashboard or with
wp plugin update wp-stripe-checkout. - Delete old plugin log files that sit in a web-accessible folder, once you have kept a copy offline for review.
- Read the retained logs for tokens, keys, email addresses or other secrets, and rotate anything sensitive.
- Add a rule at your web server or host to deny direct access to files you do not intend to serve.
Why it matters
Logs are written for developers, and developers log more than they should. When a log file sits in a folder the web server serves, the secrecy of its contents depends on nobody guessing the path. CWE-532 (Insertion of Sensitive Information into Log File) covers exactly that habit.
The fix removes the exposure going forward. It does not undo what was already readable, so treat anything that was in the log as potentially seen. The KEV flag in the record is false, and none of the sources we read claim exploitation in the wild.
For a wider view of your own code, the free in-browser dependency scan and the Gold directory show which packages carry known CVEs, and reachability analysis helps you decide which findings to fix first. WordPress plugins installed from the admin screen do not sit in a manifest, so start with the wp-cli inventory above for those.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Does updating remove the data that was already exposed?
No. The update closes the hole. Data that was readable before the update may have been seen, so review it and rotate secrets.
Do I need to tell anyone?
That depends on what was exposed and on your legal duties. Work out what the plugin held, then involve whoever owns privacy and compliance for the site.
Sources
Last reviewed: 19 October 2026.
