WooCommerce 11.2.0 came out on 7 October 2026. The WooCommerce team writes that the version contains security fixes and recommends updating all stores to it. It also changes the database, so the update starts with a backup.
What changes in security with WooCommerce 11.2
The release notes describe five security changes. Some of them can stop something that used to work, so go through them.
- No Cc or Bcc on emails that carry a link. The Reset password, New account and Confirm email address emails contain a link for changing a password or confirming an address. So recipients in copy (Cc and Bcc) can no longer be set for them, and saved addresses are ignored. The same change applies to the Back in Stock verification email.
- Stricter checks on download credentials. WooCommerce rejects malformed order and email credentials before it checks the permission. Ordinary download links do not change. A rare hand-made or imported link, or a record with malformed data, may stop working. Then reissue the link, fix the record, or correct the billing email on the order and regenerate the permissions. That resets the download counts and logs.
- Shop managers edit only allowed roles. They can no longer edit users with a role outside
woocommerce_shop_manager_editable_roles, for example bbPress or Ultimate Member roles. Administrators still can, and a new role is added through that filter. - Blueprint import on multisite. It now needs a network super admin. Single-site stores are not affected.
- Usage data. If you agreed to share it, WooCommerce now checks that it does not send sensitive information.
Before 11.2 two more updates came out that carry the mark "Security update: Yes" in their notes. Version 11.1.1 of 18 September improves the checks for API permissions, authentication and session handling. Version 11.1.2 of 22 September has the same mark, and among its changes is a stricter validation of email product reviews.
What else is in version 11.2
Two novelties are not about security.
- Withdrawal request emails. WooCommerce now has configurable emails for order withdrawal requests. One confirms to the customer that the request was received, and the other notifies you when a customer submits one. They are set up in
WooCommerce > Settings > Emails, where you choose the recipients and the additional text, see a preview and switch each email on or off. - A date field at checkout. The additional checkout fields API now supports dates. Extensions and developers can collect, through the Checkout block, for example a birthday or a preferred delivery date.
What to do before and after the update
- Back up the files and the database, because the version changes the database. How to do it is described in the backup guide.
- If you use PublishPress Future, update it to 4.10.4 or newer.
- Update WooCommerce to 11.2 from
Pluginsor from WP Toolkit, as in the WP Toolkit guide. - Place a test order and check the emails for a new account and a forgotten password. If you sell downloadable products, download one file.
- If your store uses WPC Product Bundles, also see the news of 6 October about the attack through it.
What we do
With vulnerability (CVE) monitoring we match WooCommerce, the plugins, the themes and WordPress on your store against vulnerability databases and tell you what to update before anyone exploits it. If you would rather not deal with the updates themselves either, see monthly maintenance. Both are for your store wherever it is hosted.
Frequently asked questions
What does WooCommerce 11.2 change in security?
WooCommerce 11.2.0 came out on 7 October 2026 with five security changes, and the team recommends updating every store. Emails with a password or confirmation link no longer accept Cc or Bcc, download credentials are checked more strictly and shop managers can edit only allowed roles. Blueprint import on multisite needs a network super admin, and usage data is checked for sensitive information.
Why do I need a backup before updating to WooCommerce 11.2?
WooCommerce 11.2 changes the database. Back up the files and the database before you update, so there is something to go back to if anything goes wrong.
Why did Cc and Bcc stop working on the new account email?
From WooCommerce 11.2 the Reset password, New account and Confirm email address emails cannot have copy recipients, because they carry a link for changing a password or confirming an address. Saved Cc and Bcc addresses are simply ignored. The same applies to the Back in Stock verification email.
Why did a product download link stop working after WooCommerce 11.2?
WooCommerce 11.2 rejects malformed order and email credentials before it checks the download permission. Ordinary links do not change, but a rare hand-made or imported link may stop working. Reissue the link, fix the record, or correct the billing email on the order and regenerate the permissions, which resets the download counts and logs.
Why can my shop manager not edit some users?
From WooCommerce 11.2 the Shop manager role cannot edit users whose role is outside the woocommerce_shop_manager_editable_roles filter, for example bbPress or Ultimate Member roles. Administrators still can. A new role is added through that filter.
What should I do if I use PublishPress Future?
Update PublishPress Future to 4.10.4 or newer before you update WooCommerce to 11.2. Versions 3.0.0 to 4.10.3 can cause a fatal error, because they load their own outdated copy of Action Scheduler instead of the one in WooCommerce.
What should I check after updating to WooCommerce 11.2?
Place a test order and check the new account and forgotten password emails. If you sell downloadable products, download one file.
What is new in WooCommerce 11.2 apart from security?
WooCommerce 11.2 adds emails for order withdrawal requests, one to the customer and one to you, set up in WooCommerce > Settings > Emails. The additional checkout fields API now supports dates, so the Checkout block can ask for, say, a birthday or a preferred delivery date.