WooCommerce security updates in 2026: what changed
WooCommerce released four security updates in 2026. The big one came on 2 March: a Store API flaw that let an attacker trick a logged-in admin into creating new admin accounts, patched in 53 point releases back to 5.4. Here is each update and how to check your store is covered.
2 March: the Store API vulnerability (CVE-2026-3589)
The Store API’s batch-request handling was open to cross-site request forgery: if a logged-in administrator visited an attacker’s page, the attacker could make the store create admin accounts. Every version from 5.4 to 10.5.2 was affected. NVD scores it 7.5 (high). WooCommerce says it saw no evidence of exploitation outside its own testing.
Instead of one fix, WooCommerce shipped a patched point release for every affected minor version — 5.4.5 up to 10.5.3, 53 releases in all — and worked with the WordPress.org plugins team to push them to stores with auto-updates on. So a store that is still on, say, 8.x can be safe without jumping to the newest major: it needs the patched release of its own line.
August and September: hardening releases
| Release | Date | What it changed |
|---|---|---|
| 11.0.1 | 10 August | Marked as a security update. Around a dozen hardening changes: salted hashing for guest session cookies, Store API cart-token validation, coupon usage limits enforced, capability checks on onboarding theme install and Marketplace subscription activation |
| 11.1.1 | 18 September | REST API credential scoping, permission checks on the legacy options API and the mobile app login, stronger guest-session validation. WooCommerce describes these as low-risk, needing a privileged admin |
| 11.1.2 | 22 September | Marked as a security update; no details published |
None of these came with a CVE or a forced update, and the WooCommerce repository on GitHub has published no security advisories in 2026. The current version is 11.2.1.
How to check your store
- Plugins → Installed Plugins: note the WooCommerce version.
- On 10.5 or older, make sure it is the patched release of that line (for example 10.5.3, not 10.5.2). Anything below 5.4 never got the patch — and is far too old to run anyway.
- Look in Users → All Users, filtered by Administrator, for accounts nobody on your team created.
- Update the extensions too. WooCommerce core is reviewed heavily; most store compromises come through payment, shipping and builder add-ons.
Sources: developer.woocommerce.com release posts and the NVD entry for CVE-2026-3589.