WooCommerce 11.2.2 security release: what store owners should do

Yes, update WooCommerce today. On November 4, 2026, WooCommerce released 11.2.2, a security release with multiple security updates, and it strongly recommends updating as soon as possible. If your store runs anything older, including 11.2.1, take a backup, update, and finish the database update it asks for.

WooCommerce gives no CVE number, no severity rating and nothing on attacks yet. WordPress.org lists more than 7 million active installations, so treat this as a job for every store you look after.

Last updated November 4, 2026, 5:00 pm Toronto time. New developments go at the top of the timeline below.

What happened with WooCommerce 11.2.2, and when?

WooCommerce shipped the release on the afternoon of November 4. Here is the order of events, newest first. Times are Toronto time, with UTC in brackets.

Is my WooCommerce store affected?

Assume it is if your store runs a version below 11.2.2, because WooCommerce has not published an affected version range that would rule you out. The areas it changed are parts most stores use. From the notes and the changelog:

• Store API and checkout: cart item quantities are validated, each checkout request starts with its own order and payment data, and checkout stops before payment if the order could not be saved.
• REST API keys: key authentication is restricted to REST API requests.
• Admin endpoints: two Jetpack connection endpoints used during onboarding now need a logged-in admin browser session.
• Data handling: tighter checks in the product CSV importer and in how payments profile data is decoded.

WooCommerce does not say which of these lines fix vulnerabilities and which are general hardening, so don’t use this list to decide your store can skip it. If you are on an older release line, the only build I can see with these changes is 11.2.2, which needs WordPress 7.0 and PHP 7.4 or newer.

What should I do today?

Back up, update, run the database update, then test a real checkout.

1. Check your version under Plugins, Installed Plugins, or with the command below. It worked if you have a number to compare with 11.2.2.
2. Take a fresh backup of the database and files, and try the update on a staging copy today if you have one, as WooCommerce’s update guide advises. It worked if you can see a backup with today’s date.
3. Click “Update now” on WooCommerce on the live site. It worked if the plugin row shows 11.2.2 after a page reload.
4. Click “Update WooCommerce Database” if the notice appears. This release includes a database update to clean up affected product attribute data. It worked if the notice is gone.
5. Place a test order, and check the cart, shipping, tax, payment and the order email. It worked if the order appears under WooCommerce, Orders with the right totals.
6. Repeat for every other store, including staging copies reachable from the internet. It worked if you can list each site with its version.

wp plugin get woocommerce --field=version

What could break after I update?

Custom code is the likeliest place, and the notes call out two changes that matter:

• Checkout errors from extensions: Store API checkout now returns an HTTP 500 if an extension callback on woocommerce_before_order_object_save, woocommerce_new_order or woocommerce_update_order throws an error. If checkout starts failing after the update, look for those hooks in your PHP error log first.
• Jetpack connection scripts: the wc-admin endpoints onboarding/plugins/jetpack-authorization-url and plugins/connect-jetpack now return a 403 to REST API keys, WP-CLI and application passwords. The notes say the wc-admin screens are not affected.

If an inventory or accounting tool connects with REST API keys, run one sync after updating, given the change to key authentication. It worked if new orders or stock changes arrive at the other end.

Do I still need to check if automatic updates are on?

Yes, because the release notes do not say automatic updates will deliver this, and a plugin update does not confirm the database step ran. Look at the version number and the database notice yourself.

Should I wait for WooCommerce 11.3 instead?

No. WooCommerce 11.3 is scheduled for the week of November 9, with its own changes to test. Take 11.2.2 now and handle 11.3 separately.

How do I check whether my store was already hit?

You can’t check for this specifically yet, because WooCommerce has published no signs to look for. I would still run the general checks on a store that matters, though finding something would not prove this is the cause:

• Administrator and shop manager accounts you did not create, under Users.
• REST API keys you do not recognise, under WooCommerce, Settings, Advanced, REST API.
• PHP files in wp-content/uploads, which should hold media and not code.

wp plugin verify-checksums woocommerce

What should I tell my host or client?

Give them the exact version and ask them to confirm the database step.

WooCommerce released 11.2.2 on November 4, 2026 as a security release. Please confirm this site runs 11.2.2, that the database update has finished, and that a test order works. Please also confirm any staging copies.

When a CVE, an affected version range or a fix for older release lines appears, I’ll add it to the timeline. Until then the routine is the same as for WordPress 7.1.4: find the version number, update, and see the result yourself.