WooCommerce Black Friday Prep: A Quick Security Check for Your Store

WooCommerce has shipped more security updates than usual since the summer, and on 6 November the WooCommerce team explained why. In a post on the WooCommerce Developer Blog, Darren Ethier sets out what has changed, how fixes now reach stores, and what store owners should check. With Black Friday a few weeks away, it is a good moment to run through that list on your own store.

Why there are more WooCommerce security updates

AI tools have made vulnerabilities much easier to find, for researchers and for WooCommerce itself. The post says reports about Woo products through Automattic’s HackerOne programme rose roughly nine times over the last year, with lots of duplicates from people pointing similar tools at the same public code.

WooCommerce has also gone looking on its own. Since August every merge to core’s trunk and release branches gets an automated security scan, deep scans across the monorepo flagged around 700 potential issues for the team to validate, and in October WooCommerce and a first batch of extensions joined Anthropic’s OSS Scanner programme. The post says WooCommerce’s own scanning has now turned up more than twice as many valid core issues as outside reports.

Most of what turns up is not urgent. About three quarters of the valid core issues tracked since July are Medium or Low severity.

How security fixes reach your store now

Security fixes now get their own patch releases by default. Critical and High severity fixes ship in the next patch release of the current version. Medium and Low fixes ship in the patch release after the next minor version. WooCommerce 11.2.2 (4 November) was the first release under this approach, and 11.3.1 is due to follow 11.3.0 with the next set.

The bigger change for store owners is required security updates. Since WooCommerce 11.2, WooCommerce.com can mark an extension’s security release as required. Stores connected to WooCommerce.com with an active subscription then install it on their next update check, usually within a day, even with auto-updates switched off. It only applies to extensions bought through the WooCommerce Marketplace, and a store set up to block automatic updates in code can still do that.

Your PHP version matters too

PHP versions before 8.2 no longer get security updates from the PHP project. WooCommerce 11.3 adds an admin notice for stores on PHP 7.4 and 8.0, 11.5 is the last release that supports them, and 11.6 (February 2027) needs PHP 8.1 or newer. WooCommerce recommends PHP 8.3 or newer.

If your store runs on WordPress.com, the post says you are already covered for PHP security releases, along with Pressable and WordPress VIP. Everyone else should check with their host.

A pre-Black Friday security check

1. Update WooCommerce, your extensions and WordPress, then check the installed version numbers. The post says to do this even if auto-updates are on.
2. Keep your store connected to WooCommerce.com and your extension subscriptions active, so required security fixes can install on their own.
3. Check your PHP version under Tools, Site Health, Info, Server, and plan a move to 8.3 or newer if you are behind.
4. Check every site you manage, including staging and development sites that are publicly reachable.
5. Test release candidates on a non-production copy so a patch release doesn’t catch you out in the middle of a sale.
6. If you find a vulnerability, report it privately through Automattic’s HackerOne programme rather than a public issue.

The post is also honest that this work has a cost. Validated security fixes currently take priority over the rest of the roadmap, so some planned features have been pushed back. For a store owner heading into the busiest weeks of the year, that is probably the right trade.