WooCommerce CVE-2026-106608: Update to 11.2.0 Now

If your store runs WooCommerce, an attacker can currently exploit a known vulnerability to gain elevated access to your site. No physical access is required, no stolen password, no prior knowledge of your business. A remote actor with no authenticated session can trigger this flaw and work with your store’s data, your customer records, and your site’s administrative functions. Every WooCommerce store running a version between 9.8.0 and 11.1.x is exposed until the update is applied.

The vulnerability carries a CVSS score of 7.2, placing it firmly in the high severity band — the category of flaw that security teams treat as a priority patch rather than a scheduled maintenance item. The CVE record for this issue confirms the affected version range as WooCommerce 9.8.0 up to, but not including, 11.2.0, which is the confirmed fix. If your store is running anything in that range and has not yet updated, the vulnerability is present and exploitable right now.

How to Check Your WooCommerce Version Before You Do Anything Else

Log into your WordPress dashboard and go to Plugins > Installed Plugins. Find WooCommerce in the list and look at the version number directly beneath the plugin name. If that number sits anywhere between 9.8.0 and 11.1.x, your store is affected.

You can also check via WooCommerce > Status > System Status. Under the “Environment” section at the top of that page, the WooCommerce version is listed alongside your PHP version and WordPress version, giving you a quick read on your store’s technical state without needing to dig through multiple screens.

WordPress will flag any available update with a notice on the Plugins screen and on your dashboard’s At a Glance panel. A yellow or red update notice next to WooCommerce means the patch is sitting there waiting to be applied, and no diagnostic tool is required. The information is already in your dashboard.

Updating to WooCommerce 11.2.0 Closes the Vulnerability

From the Plugins screen, click Update Now beneath the WooCommerce listing. WordPress will download and install 11.2.0 automatically, typically in under a minute. Once complete, return to WooCommerce > Status > System Status and confirm the version shown is 11.2.0 or higher.

Before updating on a live store, take a full site backup. Your hosting control panel will have a backup tool, or you may already have a backup plugin in place. A backup takes five minutes and gives you a restore point if anything behaves unexpectedly after the update — insurance, not an expectation of failure. On a well-maintained store, plugin updates of this type apply without issue.

If your store is managed through a staging environment, apply the update there first, confirm your checkout flow, product pages, and payment gateway integrations all work as expected, then push to production. For most stores, the risk of the vulnerability far outweighs the risk of the update.

One specific area to check after updating: the WooCommerce > Settings > Advanced > REST API screen. If your store uses the WooCommerce REST API to connect to a third-party system — an ERP, a CRM, or a stock management tool — verify that your API keys are still active and that the connected service is responding correctly, as a major version update can occasionally require a key refresh in that screen.

Keeping Plugins Updated Is a Business Decision, Not a Technical One

Plugin updates exist because software has flaws. Developers find them, patch them, and release the fix. The gap between a patch being released and a site owner applying it is the window during which an attacker can act, and that window is real. Automated scanning tools probe WordPress sites continuously, testing for known vulnerabilities by version number, and when a CVE is published with a version range, those scanners update within hours.

A store running a vulnerable version of WooCommerce holds customer names, email addresses, billing addresses, and order histories. Depending on your payment setup, partial card data may also be stored. A successful exploit affects every customer who has placed an order through the store, not just the site itself. Delaying this update is an active choice with a named consequence.

Business owners often treat plugin updates as a task for a developer or a future maintenance window. The CVSS 7.2 rating on this vulnerability means it should wait for neither. The update is available now and takes less time to apply than reading this post.

There is one angle that often goes unconsidered: your hosting provider’s terms and your payment processor’s requirements. Many managed hosting agreements place responsibility for keeping software updated on the site owner. PCI DSS, the security standard that governs card payment processing, requires that software vulnerabilities be addressed within defined timeframes based on severity. A CVSS 7.2 rating triggers those requirements, and running a known-vulnerable version of WooCommerce whilst processing card payments creates a compliance exposure your payment processor can act on, quite apart from the security risk itself.

---

If your WooCommerce store is running a version below 11.2.0, I can apply the update, verify your checkout and API connections, and confirm the vulnerability is closed. Given the compliance implications of running a CVSS 7.2 vulnerability on a store that processes card payments, this is not something to schedule for next week. Get the update applied today.