Yes, check your WooPayments version today. On November 3, 2026, WooCommerce published a security advisory for WooPayments and fixed versions for every release line back to 9.0. The current fixed version is 11.2.1. If your store is on 11.2.0 or an older unfixed version, update it now, even if you do not sell subscriptions.
WooCommerce has not said much yet. The advisory gives no CVE number, no severity rating and no technical details, and it does not say whether anyone has been attacked. WordPress.org lists more than 800,000 active installations, so check every store you look after.
Key takeaways
- Check your WooPayments version today, even if you do not sell subscriptions. WooCommerce published a security advisory on November 3, 2026, and the current fixed version is 11.2.1. arvindkumar.ca
- The advisory lists a fixed version for every release line back to 9.0, so match your installed version against the list. Anything older than 9.0.0 should go to 11.2.1. arvindkumar.ca
- Check the version on every site you manage, update the ones that need it, then run a test payment. Staging and development copies that can be reached from the internet count too. arvindkumar.ca
- Do not trust automatic updates until you have seen the fixed version yourself. WooCommerce says to check even when automatic updates are on or a host manages them, and it has published no CVE, severity rating or signs of attack. arvindkumar.ca
Summarised from this post, formatted for answer engines.
Last updated November 3, 2026, 7:25 pm Toronto time. New developments go at the top of the timeline below.
What happened with the WooPayments security update, and when?
WooCommerce shipped the fix and the advisory on the same day, about three months after a related fix for its Subscriptions extension. Here is the order of events, newest first. Times are Toronto time, with UTC in brackets.
Tuesday, November 3, 12:40 pm (17:40 UTC): WooCommerce’s help page says the update may already be installed
WooCommerce’s WooPayments subscriptions documentation, last changed at this time, now carries a notice dated November 3. It says you may have seen a notice about the update in WP Admin, or that the update may have been installed automatically. It also calls this update separate from the August advisory below.
Tuesday, November 3, 11:25 am (16:25 UTC): WooCommerce publishes its advisory
The advisory says the update addresses a security issue in the subscriptions functionality bundled with WooPayments, “extending a fix announced in August”. It lists a fixed version for every release line from 9.0 up, and sends anything older to 11.2.1. It tells owners to check the installed version even when automatic updates are on or a host manages updates.
Tuesday, November 3: WooPayments 11.2.1 reaches WordPress.org
The plugin’s changelog dates 11.2.1 to November 3 and gives one line for it: “Security update.” I could not find the exact time of the release.
Wednesday, August 5: WooCommerce fixes vulnerabilities in the Subscriptions extension
WooCommerce told users of WooCommerce Subscriptions to update to 9.1.0 or later. It said the worst of several vulnerabilities could let an unauthorised user take control of a site, and that it had no evidence of a compromised store. The November advisory says nothing either way.
Is my WooPayments store affected?
It is if your installed version is below the fixed version for its release line in the list further down. The advisory does not limit this to stores that sell subscriptions, so do not rule yourself out on that basis.
One thing I can’t explain: WooCommerce’s documentation says the built-in subscriptions feature was removed at version 10.2.0, yet the advisory lists later versions, up to 11.2.0. WooCommerce has not published the details that would settle this, so go by the version list and not by whether you use the feature.
Which WooPayments version fixes it?
The newest fix is 11.2.1, and the advisory gives each older release line its own. Find your installed version on the left of each pair:
- 11.x: 11.2.0 to 11.2.1; 11.1.0 to 11.1.1; 11.0.0 or 11.0.1 to 11.0.2.
- 10.x: 10.9.0 to 10.9.1; 10.8.0 to 10.8.1; 10.7.0 or 10.7.1 to 10.7.2; 10.6.0 to 10.6.1; 10.5.0 or 10.5.1 to 10.5.2; 10.4.0 to 10.4.1; 10.3.0 or 10.3.1 to 10.3.2; 10.2.0 to 10.2.1; 10.1.0 or 10.1.1 to 10.1.2; 10.0.0 to 10.0.1.
- 9.x: 9.9.0 to 9.9.1; 9.8.0 to 9.8.1; 9.7.0 to 9.7.1; 9.6.0 to 9.6.1; 9.5.0 to 9.5.1; 9.4.0 to 9.4.1; 9.3.0 to 9.3.1; 9.2.0 or 9.2.1 to 9.2.2; 9.1.0 to 9.1.1; 9.0.0 to 9.0.1.
- Older than 9.0.0: go to 11.2.1.
What should I do today?
Check the version on every site, update the ones that need it, then run a test payment.
- Open Plugins, Installed Plugins and find WooPayments, or run the command below. It worked if you have a version number to compare with the list above.
- Click “Update now” if your version is not fixed. It worked if the plugin row shows the fixed version after a page reload. If your store is already on a fixed version, you can stop here for that site.
- Run a test payment at checkout. It worked if the order goes through and appears under WooCommerce, Orders.
- Repeat for every other site you manage, including staging and development copies that can be reached from the internet. It worked if you can list each site with its version, because an update on one site tells you nothing about another.
- Contact WooCommerce Support if the update does not appear or fails, and include your version and any error. It worked if you have a reply with a next step.
wp plugin get woocommerce-payments --field=versionIf you run the separate WooCommerce Subscriptions extension, check that too. It needs 9.1.0 or later from the August advisory, and WooPayments 11.2.1 does not update it for you.
Do I still need to check if automatic updates are on?
Yes, because WooCommerce itself says to check, even when automatic updates are on or a host manages updates. Its help page says the update may have been installed for you, but it does not say every store will get it. Once you see a fixed version, you do not need to update again.
How do I check whether my store was already hit?
You can’t check for this vulnerability specifically yet, because WooCommerce has not published any signs to look for. I’d still run the general checks on a store that matters, keeping in mind that finding something would not prove this update is the cause:
- Administrator accounts you did not create, under Users.
- PHP files in wp-content/uploads, which should hold media and not code.
- Plugin files that differ from the official copy, which the command below lists.
wp plugin verify-checksums woocommerce-paymentsWhat should I tell my host or client?
Tell them the exact version the site needs and ask for confirmation of the version it is running now.
WooCommerce issued a security advisory for WooPayments on November 3, 2026. Please confirm which WooPayments version this site runs and update it to the fixed version for its release line (11.2.1 for current sites). Please also confirm any staging copies.
When I checked, Patchstack’s database had no entry for this yet, and I could not read Wordfence’s. When a CVE or more detail appears, I’ll add it to the timeline. The routine is the same as for WordPress 7.1.4: find the version number, match it against the fixed list, and don’t trust an automatic update until you have seen it yourself.