WooCommerce says the flood of security updates this year is no accident. In a post on its blog, the team explains what it changed since June and what store owners should do now.

Why so many updates

AI tools have made it much easier to find bugs. WooCommerce says reports about its products through Automattic’s HackerOne program rose roughly nine times over the past year. Many were duplicates, because people point similar tools at the same public code.

The team also went looking itself. It says an August scan flagged about 700 possible issues, and each was checked and fixed if real. Every code merge into core now gets an automated security scan. In October, WooCommerce joined Anthropic’s OSS Scanner program, which returned about 200 findings. The team says roughly 90% of those in core were valid, with fixes due in 11.2.2 and 11.3.1.

WooCommerce says about three quarters of the valid core issues since July are medium or low severity.

Required updates, even with auto-updates off

This is the biggest change for store owners. Starting with WooCommerce 11.2, WooCommerce.com can mark an extension’s security release as required. Connected stores with an active subscription install it on the next update check, usually within a day. That happens even if you turned auto-updates off.

It applies only to security fixes, and only to Marketplace extensions. Stores that block updates in code are not affected.

Security fixes also now ship in dedicated patch releases. Critical and high fixes go into the next patch. Medium and low fixes wait for the patch after the next minor version.

PHP versions are being phased out

PHP no longer issues security updates for versions before 8.2. WooCommerce plans these steps:

  • 11.3 shows an admin notice on PHP 7.4 and 8.0.
  • 11.5 is the last release to support those versions.
  • 11.6, due in February 2027, requires PHP 8.1 or newer. PHP 8.3 or newer is recommended.

WooCommerce says about 9% of tracked stores still run PHP 7.4 or 8.0.

What to do now

  1. Update WooCommerce, your extensions, and WordPress. After a security update, confirm the installed version, even with auto-updates on.
  2. Keep your store connected to WooCommerce.com and your subscriptions active, so required fixes can install.
  3. Check your PHP version under Tools, Site Health, Info, Server. Plan a move to PHP 8.3 or newer, and ask your host whether the latest PHP security releases are applied.
  4. Check staging and development sites too.
  5. Test release candidates on a staging site before they ship.

The latest example is the WooPayments fix from last week. The PHP risk is the same one in the critical PHP release from three weeks ago.

End of article