# WooCommerce security updates in 2026: what changed

WooCommerce released four security updates in 2026. The big one came on 2 March: a Store API flaw that let an attacker trick a logged-in admin into…

Source: https://webkodingtheme.com/blog/woocommerce-security-updates-2026/

---

Operations and admin

# WooCommerce security updates in 2026: what changed

AÖ Arif Özelci · Published 30 Oct 2026 · 5 min read
WooCommerce released four security updates in 2026. The big one came on 2 March: a Store API flaw that let an attacker trick a logged-in admin into creating new admin accounts, patched in 53 point releases back to 5.4. Here is each update and how to check your store is covered.

## 2 March: the Store API vulnerability (CVE-2026-3589)

The Store API’s batch-request handling was open to cross-site request forgery: if a logged-in administrator visited an attacker’s page, the attacker could make the store create admin accounts. Every version from 5.4 to 10.5.2 was affected. NVD scores it 7.5 (high). WooCommerce says it saw no evidence of exploitation outside its own testing.
Instead of one fix, WooCommerce shipped a patched point release for every affected minor version — 5.4.5 up to 10.5.3, 53 releases in all — and worked with the WordPress.org plugins team to push them to stores with auto-updates on. So a store that is still on, say, 8.x can be safe without jumping to the newest major: it needs the patched release of its own line.

## August and September: hardening releases

Release Date What it changed
11.0.1 10 August Marked as a security update. Around a dozen hardening changes: salted hashing for guest session cookies, Store API cart-token validation, coupon usage limits enforced, capability checks on onboarding theme install and Marketplace subscription activation
11.1.1 18 September REST API credential scoping, permission checks on the legacy options API and the mobile app login, stronger guest-session validation. WooCommerce describes these as low-risk, needing a privileged admin
11.1.2 22 September Marked as a security update; no details published
None of these came with a CVE or a forced update, and the WooCommerce repository on GitHub has published no security advisories in 2026. The current version is 11.2.1.

## How to check your store

- Plugins → Installed Plugins: note the WooCommerce version.
- On 10.5 or older, make sure it is the patched release of that line (for example 10.5.3, not 10.5.2). Anything below 5.4 never got the patch — and is far too old to run anyway.
- Look in Users → All Users, filtered by Administrator, for accounts nobody on your team created.
- Update the extensions too. WooCommerce core is reviewed heavily; most store compromises come through payment, shipping and builder add-ons.
Sources: developer.woocommerce.com release posts and the NVD entry for CVE-2026-3589.
WebKoding’s WooCommerce extensions are tested against the current WooCommerce release. [See them](/plugins). Browse the plugins →

AÖ
Arif Özelci Builds the WebKoding plugins. Answers support himself.
Share on X LinkedIn Copy link
In this article 2 March: the Store API vulnerability (CVE-2026-3589) August and September: hardening releases How to check your store
Related WordPress security releases in 2026: every fix listed WordPress plugin vulnerabilities in 2026: the worst ones WooCommerce emails not sending: order emails and test emails