tadrik Free store check

Plugin security / WooCommerce

WooCommerce vulnerability: is your WooCommerce store affected?

WooCommerce has 4 serious security holes rated 7 or higher out of 10 that someone can use with no login or with only a customer account. The newest was published on 4 September 2026. Every one is fixed: update to 11.1.0 or newer.

Short answer: your store is affected if it runs WooCommerce older than 11.1.0. Update to 11.1.0 or newer, on a copy of the store first if you can.

In our check of 3,600 live UK and US WooCommerce stores (31 October 2026 to 1 November 2026), 457 were running a version of WooCommerce with a serious hole that already had a fix. How we checked.

The security holes

Newest first. Each one is published in a public security database and fixed in the version shown.

  1. Denial of service

    Someone could make the store stop responding.

    Score 7.5 (high)no login neededAffected: older than 11.1.0Fixed in 11.1.0Published 4 September 2026CVE-2026-48888

    Advisory: Allocation of Resources Without Limits or Throttling vulnerability in Automattic WooCommerce allows HTTP DoS. This issue affects WooCommerce: from n/a before 11.1.0.

3 older holes, published before 1 January 2023

  1. Deletion

    Someone could delete content or files, which can take the store down.

    Score 8.1 (high)needs only a customer accountAffected: older than 3.4.6Fixed in 3.4.6Published 6 November 2018CVE-2018-20714

    Advisory: The logging system of the Automattic WooCommerce plugin before 3.4.6 for WordPress is vulnerable to a File Deletion vulnerability.

  2. File access

    Someone could read files on your server they should never see.

    Score 7.5 (high)no login neededAffected: older than 4.0Fixed in 4.0Published 29 November 2017CVE-2017-17058

    Advisory: The WooCommerce plugin through 3.x for WordPress has a Directory Traversal Vulnerability via a /wp-content/plugins/woocommerce/templates/emails/plain/ URI, which accesses a parent directory.

  3. Privilege escalation

    A user could give themselves more rights, up to full admin.

    Score 8.8 (high)needs only a customer accountAffected: older than 3.2.4Fixed in 3.2.4Published 16 November 2017CVE-2017-18356

    Advisory: In the Automattic WooCommerce plugin before 3.2.4 for WordPress, an attack is possible after gaining access to the target site with a user account that has at least Shop manager privileges.

How to check your version

  1. Log in to WordPress and open Plugins > Installed Plugins.
  2. Find WooCommerce. The version number is under its name. If it is lower than 11.1.0, your store is affected.
  3. No login to hand? Open https://yourstore.com/wp-content/plugins/woocommerce/readme.txt in a browser, with your own address in place of yourstore.com, and read the Stable tag line. Some hosts block this file; then use step 1.

How to fix it

  1. Make a backup, or better, a staging copy of the store (most hosts have a one-click staging button).
  2. On the copy, update WooCommerce to 11.1.0 or newer: Dashboard > Updates, or Update now on the Plugins page.
  3. If no update shows, it may be a paid version whose licence has run out: download the new version from the seller's site and upload it.
  4. Place a test order on the copy: add to cart, check out, pay with a test method. Check the pages that use WooCommerce.
  5. If everything works, make the same update on the live store and place one more test order.
  6. If you no longer use WooCommerce, delete it instead of leaving it deactivated.

Not sure, or no time?

Get a free check of your store: we look at its public pages for plugins with known holes, and reply within one working day. Or we fix it for you: we update your store on a copy, place a test order, and only then change the live store, for a fixed £99 / $119.

Free store check Fix it for me on a copy

Questions

Which WooCommerce version fixes it?
Version 11.1.0 or newer fixes all 4 issues on this page.
How do I know if my store is affected?
Your store is affected if it runs WooCommerce older than 11.1.0. In WordPress, open Plugins and read the version under WooCommerce. Without logging in, open yourstore.com/wp-content/plugins/woocommerce/readme.txt and read the Stable tag line.
I don't use WooCommerce any more. Is a deactivated copy safe?
Deactivating it lowers the risk but leaves the old code on your server. If you don't use it, delete it; if you do, update it.
Can someone fix it for me?
Yes. We update the store on a copy first, place a test order, and only then make the same change on the live store, for a fixed price.

Vulnerability data: WPVulnerability (wpvulnerability.net, CC0), which links each entry to its CVE or advisory. Store numbers: Tadrik's own checks of public pages, aggregates only. Page updated 3 November 2026.