WooCommerce 11.2.2 and WooPayments security updates explained
WooCommerce 11.2.2 and a WooPayments subscriptions fix are both security updates. How to check your versions, update safely and test your checkout.
WooCommerce released version 11.2.2 on 4 November 2026. It describes it as a security release with multiple security updates and strongly recommends installing it as soon as possible. A day earlier, WooCommerce published a separate security fix for WooPayments covering the subscriptions features built into that plugin. If you run an online shop on WooCommerce, and especially if you take subscription payments through WooPayments, both updates belong on this week’s to-do list.
What WooCommerce 11.2.2 changes
The release tightens security in the Store API and REST API. These are the systems your checkout and any connected apps use to talk to your shop. It also improves how CSV product imports are checked and makes some admin endpoints more secure.
The detailed changes include:
- stricter handling of cart quantities, REST API key logins and tax calculation for local pickup orders
- if an order fails to save at checkout, it no longer goes on to payment
- each checkout request now starts with its own order and payment data
- safer handling of product default attributes when a global attribute is renamed
- a fix so that changing a shipping address in PayPal Standard recalculates shipping and tax correctly
This release also includes a database update. After the plugin itself updates, you will see a prompt to run “Update WooCommerce Database”. This step matters, because part of it cleans up product data affected by the attribute issue above.
Two changes that could affect other plugins
WooCommerce flags two behaviour changes. First, if another extension that hooks into order saving throws an error during checkout, checkout now stops and shows an error. Previously it carried on with a partly saved order. That is safer, but it means a badly behaved extension could now make checkout fail visibly.
Second, two Jetpack connection endpoints now require a logged-in administrator. Requests using API keys, WP-CLI or application passwords will be refused. WooCommerce says the normal admin screens are not affected, so most shop owners will not notice this one.
The practical upshot is simple: after updating, place a test order.
The WooPayments subscriptions fix
On 3 November 2026 WooCommerce published a security update for WooPayments. It fixes an issue in the subscriptions functionality bundled with WooPayments, and extends a fix announced in August 2026.
That August advisory concerned the separate WooCommerce Subscriptions extension. WooCommerce found several issues in an internal review, said the most serious could let an unauthorised user take control of a site, and told users to update to version 9.1.0 or later. At the time it said it had no evidence that any store had been compromised. That statement covered the August issues only and should not be read as applying to this November fix.
Fixed WooPayments versions exist for every release line from 9.0 upwards. For example:
- 11.2.0 → 11.2.1
- 11.1.0 → 11.1.1
- 11.0.0 or 11.0.1 → 11.0.2
- 10.9.0 → 10.9.1
- 9.0.0 → 9.0.1
If your site is on a version older than 9.0.0, WooCommerce says to update to 11.2.1. The full table is in the advisory linked below. If you are already on a fixed version, you do not need to update again.
Do not mix up the numbers
WooPayments and WooCommerce now use similar-looking version numbers, which makes this easy to get wrong. They are separate plugins. The fixed WooCommerce version is 11.2.2. The latest fixed WooPayments version is 11.2.1. Check each one on its own.
What is not known yet
Neither November announcement says whether these issues are being exploited, how severe they are, or what an attacker could do with them. No CVE IDs (the standard public reference numbers for vulnerabilities) have been published in WooCommerce’s notes. It is also unclear whether shops on older WooCommerce lines, such as 11.1.x, will get their own patch or need to move to 11.2.2.
For WooPayments, WooCommerce does not say whether shops that do not use its subscriptions features are affected. It tells every WooPayments store to check, so that is the sensible advice. Announcements like these are sometimes revised after publication, so it is worth rechecking them if you are reading this a few days on.
What you should do
If we look after your website
Updates like these are part of what your care plan covers, so there is nothing you need to do yourself. If you sell subscriptions through WooPayments and want confirmation of the versions your shop is running, just ask.
If you manage it yourself
1. Check your versions. In WP Admin, go to Plugins → Installed Plugins. Note the version of WooCommerce and, if you use it, WooPayments. WooCommerce says to do this even if automatic updates are switched on or your host manages updates for you. If you also use the separate WooCommerce Subscriptions extension, confirm it is on 9.1.0 or later.
2. Include every copy of your site. If you have a staging or development copy that is publicly accessible, check that too.
3. Back up first. WooCommerce’s own guide recommends backing up both the database (products, orders, settings) and the wp-content folder. Ideally, test the update on a staging site before touching the live shop.
4. Update in a quiet window. Put the shop into “Coming soon” mode so no one checks out while files and the database are changing. Update from Plugins → Installed Plugins and wait for it to finish before clicking away. Then run the WooCommerce database update when prompted. You can watch its progress under Scheduled Actions. Update your other extensions, theme and payment gateways in the same window, using each extension’s “Tested up to” WooCommerce version as a guide to compatibility.
If your WooPayments version is older than 9.0.0, the jump to 11.2.1 is a big one. The advisory does not say whether it needs newer versions of WooCommerce or WordPress, so test on staging first.
5. Confirm the new versions. Go back to Installed Plugins and check the version numbers have actually changed.
What to test before reopening
Before you switch off Coming soon mode:
- browse the shop and a few product pages
- add something to the cart
- place a test order, including a subscription product if you sell them
- check shipping, tax, payment and the order emails
- look for admin notices or failed scheduled actions
If something breaks, keep checkout offline, restore from your backup if needed and work out the problem on staging. If an update will not appear or fails, contact WooCommerce Support with your installed version and any error message. For paid extensions such as WooCommerce Subscriptions, also check your site is connected to your WooCommerce.com account with an active licence. Refreshing under WooCommerce → Extensions → My Subscriptions can clear stale update information.
If you would rather not handle shop updates and checkout testing yourself, our care plans cover this kind of work as standard.