Skepra

Skepra / Web recovery & resilience

WooCommerce 11.2.2 security release.

On 4 November 2026, WooCommerce released version 11.2.2 with multiple security updates and a database update. This page records the vendor release.

Ask whether this applies to your site

What was published

WooCommerce describes 11.2.2 as a security release. The release notes list hardening for Store API cart-item quantities, REST API key authentication, local-pickup checkout tax calculation, product attributes, payment-profile decoding, CSV-import column mapping and admin connection endpoints. The release also includes a database update to clean up affected attribute data.

Checkout handling

For Store API checkout, WooCommerce now returns a 500 error when an extension callback throws while an order is being saved. Before this change, checkout could continue with a partially saved order. The vendor says the change applies to callbacks on woocommerce_before_order_object_save, woocommerce_new_order or woocommerce_update_order; save() itself does not throw.

Affected versions

The vendor release notes do not state CVE identifiers or a complete affected-version range. They identify 11.2.2 as the release containing the announced fixes. Confirm the deployed version and relevant workflow before planning a change.

How to check whether this is relevant

Ask the store owner or maintainer which WooCommerce version is in use and whether its customer journey uses Store API checkout or relevant extensions. Review the vendor notes and the planned maintenance window together. Do not send store credentials, payment data, database dumps or full logs through the public contact route.

Safe update route

Agree the maintenance scope and owner authorisation first. Take a recoverable backup, update through the agreed route, complete any required database update, then test the relevant checkout, payment and order-confirmation journey before closing the change.