WooCommerce has released a security update for WooPayments, its payments plugin. If you take payments with it, check your version today.
According to the WooCommerce developer announcement, the issue sits in the subscriptions features bundled with WooPayments. It extends a fix for WooCommerce Subscriptions that WooCommerce announced in August. The announcement does not describe the flaw in detail, give a severity rating, or say whether attackers are using it.
Which version to install
WooCommerce published a patched release for every version line, back to 9.0.0. Stores on anything older than 9.0.0 should move to 11.2.1.
Here are the most recent lines:
- 11.2.0: update to 11.2.1
- 11.1.0: update to 11.1.1
- 11.0.0 to 11.0.1: update to 11.0.2
- 10.9.0: update to 10.9.1
Older lines have matching patches, such as 10.8.1 and 10.7.2. The announcement lists them all.
What to do
- In your WordPress admin, open Plugins, then Installed Plugins.
- Find WooPayments and note its version.
- Compare it with the table in the announcement.
- Click Update now if an update is waiting.
- Check the version again to confirm it matches a fixed release.
Do this even if your host or auto-updates manage the plugin. Agencies should check every site they manage, including staging and development copies.
If the update is missing or fails, WooCommerce says to contact WooCommerce Support. Send them your installed version and any error message.
End of article