A WooCommerce store holds orders, addresses, phone numbers and customer accounts: every vulnerability in the plugin therefore touches personal data, sometimes without any account. From the forced update of July 2021 to the three high-severity vulnerabilities of fall 2026, here is what was found, fixed and exploited, and the settings that limit the risk.
WooCommerce in brief
WooCommerce is the most installed e-commerce plugin for WordPress. Published by Automattic, which also publishes Jetpack, it has been in the wordpress.org directory since September 2011 and shows more than 7 million active installations. It handles the catalog, the cart, checkout, customer accounts, transactional emails and a full REST API, including the Store API used by the Cart and Checkout blocks.
These public features are precisely what make it a target: checkout, account creation and the Store API are reachable without logging in, and a single vulnerability can be replayed on millions of stores. The Shop Manager role, often given to employees or contractors, is another sensitive point.
Timeline of WooCommerce vulnerabilities
The table includes the significant vulnerabilities: rated high, exploitable without an account, exploited or fixed through a wave of releases. The dates are those of the first publication by WooCommerce, WPScan or Patchstack. The CVSS v3.1 scores are those of the CVE authority; when WPScan differs, both are shown.
| Published | Fixed in | Type | CVSS | CVE | Account required | Exploitation |
|---|---|---|---|---|---|---|
| November 5, 2020 | 4.6.2 | Account creation at checkout despite the setting | 6.3 (WPScan) | None | None | Yes, by bots (WooCommerce) |
| July 15, 2021 | 5.5.1 and more than 90 versions (affected: 3.3 to 5.5, and WooCommerce Blocks 2.5 to 5.5) | SQL injection via the Store API | 7.5 | CVE-2021-32789 | None | "Limited" according to WooCommerce; reported by WPScan |
| July 15, 2021 | 5.5.1 (affected: 3.3 to 5.5) | Blind SQL injection via webhooks | 4.9; 7.2 (WPScan) | CVE-2021-32790 | Administrator or API keys | Not documented |
| February 22, 2022 | 6.2.1 | Deletion of reviews, comments and order notes | 4.3 | CVE-2022-0775 | Subscriber | Not documented |
| March 10, 2022 | 6.3.1 | Orders marked as paid via PayPal Standard | 3.7 (WPScan) | None | None | Not documented |
| June 10, 2024 | 8.8.5 and 8.9.3 (affected: 8.8.0 to 8.9.2) | Reflected XSS via Order Attribution | 5.4; 7.1 (WPScan) | CVE-2024-37297 | None (victim must click) | Not documented |
| October 14, 2024 | 9.1.0 | HTML injection in orders displayed to the administrator | 5.3 | CVE-2024-9944 | None | Not documented |
| December 3, 2024 | 9.4.3 | XSS via postMessage | 7.1 (WPScan) | None | None (victim must click) | Not documented |
| December 3, 2024 | 9.4.3 | Order creation despite guest checkout being disabled | 5.3 (WPScan) | None | None | Not documented |
| December 22, 2025 | 10.4.3 and patch releases back to 8.1.3 (affected: 8.1 to 10.4.2) | Reading guest orders via the Store API | 6.5 | CVE-2025-15033 | Customer | No evidence (WooCommerce) |
| March 2, 2026 | 10.5.3 and 52 branches (affected: 5.4 to 10.5.2) | CSRF allowing creation of an administrator | 7.5 | CVE-2026-3589 | None (logged-in administrator who clicks) | No evidence (WooCommerce) |
| September 4, 2026 | 11.0 | Blind SQL injection | 7.6; 6.8 (WPScan) | CVE-2026-57777 | Shop Manager | Not documented |
| September 7, 2026 | 11.1.0 | Denial of service | 7.5 | CVE-2026-48888 | None | Not documented |
| October 8, 2026 | 11.2.0 (affected: 9.8.0 to 11.1.2) | Privilege escalation to administrator | 7.2 | CVE-2026-106608 | Shop Manager | Not documented |
The rest consists of low or medium-severity vulnerabilities, almost always requiring an account. In 2020, an order status leak (CVE-2020-29156) and two XSS; in 2021, an administrator XSS and a leak of analytics reports; in 2022, a path traversal in the importers and an HTML injection. In 2023: four information exposures (fixed in 7.0.1, 7.9 and 8.1.1) and a contributor stored XSS shared by WooCommerce and WooCommerce Blocks (CVE-2023-47777). In 2024, two CSRF, a reflected XSS, access to private products and Shop Manager XSS; in 2025, two XSS and a Shop Manager SQL injection (fixed in 9.9.4) and a data leak on multisite.
Finally, in June 2026, VulnCheck rated 9.8 a CVE (CVE-2022-50972) derived from an old Exploit-DB post about WooCommerce 7.1.0. Absent from the WPScan and Patchstack lists and not confirmed by the vendor, it is not included here.
The notable vulnerabilities explained
November 2020: bots create accounts despite the setting
Before version 4.6.2, WooCommerce accepted the createaccount parameter sent at checkout even when account creation was disabled. In its advisory of November 5, 2020, WooCommerce stated that a bot was exploiting this flaw to create orders and accounts in bulk, in order to gain authenticated access and probe other vulnerable plugins reserved for logged-in users. WooCommerce 4.6.2 and WooCommerce Blocks 3.7.1 honor the setting again; the vendor recommended deleting the accounts created by the bot.
July 2021: the SQL injection that triggered a forced update
On July 13, 2021, a researcher named Josh reported an SQL injection in the Store API through Automattic's HackerOne program. A crafted URL to the wc/store/products/collection-data endpoint let an anonymous visitor run a read SQL query: orders, customers and admin data could leak depending on what the store held. The vulnerability affected WooCommerce 3.3 to 5.5 and the WooCommerce Blocks plugin 2.5 to 5.5; a second injection, limited to administrators or API key holders, targeted the webhook search. WPScan notes that the common cause was the use of sanitize_text_field, a function designed against XSS, not against SQL injection.
The response was fast: a fix released on July 14, more than 90 versions patched, and the same day wordpress.org rolled out an automatic security update to the affected stores, as the WooCommerce team confirmed in the comments on its advisory. WPScan specifies that these updates were forced, even where automatic updates were disabled, and that they are never 100% effective. WooCommerce considered that any exploitation had been "limited"; WPScan reported accounts of compromised sites. The vendor recommended changing administrator passwords and API keys.
2024: XSS and orders without an account
In June 2024, WooCommerce published an advisory about an XSS introduced in 8.8 by the Order Attribution feature, enabled by default: data read by the Sourcebuster.js library was inserted without sanitization into the registration and classic checkout forms. A crafted link was enough to run JavaScript in the victim's browser. Versions 8.8.5 and 8.9.3 fix the vulnerability. In December, version 9.4.3 fixed another XSS, via poorly checked postMessage messages, and a flaw that allowed orders to be created without an account even when guest checkout was disabled.
December 2025 and March 2026: two Store API vulnerabilities, fixed on dozens of branches
On December 22, 2025, WooCommerce announced that a logged-in customer could read orders placed by guests, via the Store API, on versions 8.1 to 10.4.2: names, emails, phone numbers, addresses, payment methods used and items, but not card numbers. Reported by Man Yue Mo and Peter Stöckli (GitHub Security Lab) through Automattic's bug bounty program, the vulnerability (CVE-2025-15033) was fixed in 10.4.3 and by patch releases back to the 8.1 branch. Automattic worked with the wordpress.org plugins team to update affected sites automatically.
On March 2, 2026, a new alert: the Store API "batch" endpoint did not restrict requests to Store API routes. An attacker could make a logged-in administrator who opened a crafted link perform calls to other REST routes, up to creating an administrator account (CVE-2026-3589). WooCommerce specifies that the attack only worked under particular browser conditions (a browser other than Chrome, or an old version of Chrome with an option enabled). Versions 5.4 to 10.5.2 were affected; 52 patch releases were published, with the same automatic rollout. In both cases, WooCommerce stated it had no evidence of exploitation outside its own testing.
Fall 2026: three high-severity vulnerabilities in five weeks
The last three vulnerabilities were found by Ananda Dhakal (Patchstack). A blind SQL injection reachable by the Shop Manager role, published on September 4, 2026, was already fixed by WooCommerce 11.0, released on August 4. An unauthenticated denial of service, tied to unbounded resource allocation, was fixed in 11.1.0 on September 3 and published a few days later. Finally, on October 8, Patchstack published a privilege escalation allowing a Shop Manager to become administrator on versions 9.8.0 to 11.1.2, fixed the day before by WooCommerce 11.2.0.
WooCommerce Payments: a separate plugin
The most exploited vulnerability in the ecosystem did not target WooCommerce itself but WooCommerce Payments: CVE-2023-28121, fixed in March 2023, allowed impersonating an administrator with a simple HTTP header, and was massively exploited in July 2023. We covered it in detail in our article on CVE-2023-28121.
What the WooCommerce history shows
- The Store API is the hot spot. The 2021 SQL injection, the 2025 order leaks and the 2026 CSRF all go through this public API used by the Cart and Checkout blocks. See our article on REST API security.
- The Shop Manager role is a target. SQL injection, XSS and privilege escalation: this role, given to people who are not administrators, has become an entry point. Apply the principle of least privilege.
- XSS remains the most frequent type, as everywhere in the ecosystem (see our article on XSS vulnerabilities).
- Severe fixes are backported and pushed. In 2021, wordpress.org forced the update; in 2025 and 2026, Automattic published dozens of patch releases with the wordpress.org plugins team and rolled them out automatically to sites that allowed it. Less severe vulnerabilities, on the other hand, are only fixed in the latest version: in 2022, the team stated it did not patch the 4.x and 5.x branches.
- Few documented exploitations for the plugin itself (2020 and 2021), but a high volume: WPScan lists 11 vulnerabilities for 2024 alone.
WooCommerce is no exception: plugin vulnerabilities number in the thousands every year, and WordPress core has its own history too, traced in our core vulnerability timeline.
Protecting your store
- Update. As of October 11, 2026, the version to reach is 11.2.0 or later; on an older branch, check that a patch release exists for each vulnerability, which is not always the case.
- Turn on automatic updates, at least for security releases: that is what made the 2025 and 2026 rollouts possible. Our guide to automatic plugin updates explains how to manage them.
- Limit Shop Manager accounts and review the list of administrators regularly. Disable account creation and guest checkout if your store does not need them.
- Remove unused WooCommerce extensions (gateways, add-ons): an unused plugin is still an attack surface.
- Add a web application firewall capable of virtual patching and rate limiting the Store API: our WAF comparison. For payments, card fraud and customer accounts, see our WooCommerce store security guide.
- Monitor published vulnerabilities for WooCommerce and its extensions: method and tools.
WP Masquerade Pro helps with this last point. Every day, it compares the versions installed on your sites with the public WPVulnerability.net database and sends you an alert by email with the severity and the fixed version. The member area also lists pending updates and vulnerable sites. It alerts, it does not fix and it is not a firewall: the update is still yours to apply. For the other building blocks of protection, see our selection of security plugins.
Key takeaways
- WPScan lists 36 vulnerabilities in the WooCommerce plugin from January 1, 2020 to October 11, 2026, 6 of them rated high and none critical.
- Two documented exploitations: account creation by bots in 2020 and the July 2021 SQL injection, which triggered a forced update by wordpress.org.
- The Store API and the Shop Manager role concentrate the recent vulnerabilities.
- Version to reach as of October 11, 2026: 11.2.0 or later.
- WooCommerce Payments is a separate plugin, with its own major vulnerability in 2023.
Sources
- CVE: CVE-2021-32789, SQL injection via the Store API (July 26, 2021) (external link, opens in a new tab)
- WooCommerce Developer Blog: WooCommerce 6.2.1 Security Fix (February 22, 2022) (external link, opens in a new tab)
- CVE: CVE-2026-3589, WooCommerce before 10.5.3, administrator creation via CSRF (March 6, 2026) (external link, opens in a new tab)
- WordPress.org: WooCommerce plugin page (active installations) (external link, opens in a new tab)
Other sources consulted: further CVE records, official vendor pages, trade press articles, WPScan and Patchstack databases.
