NEWS
Checkout Files Upload for WooCommerce lets anyone upload PHP. See whether yours is affected
Send an inquiry
BG / ENInquiry
Security

WooPayments releases a subscriptions fix for all versions

# TagsSecurityWooCommerce
The WPhost team9 min read

On 3 November 2026 WooCommerce released a security update for WooPayments, its own plugin for taking card payments in an online store. It fixes an issue in the subscriptions code that comes bundled with WooPayments and, according to WooCommerce, extends a fix announced in August. The update was released for every branch of the plugin from 9.0 to 11.2, and the newest version is 11.2.1.

WooCommerce has not said what exactly the issue is, how serious it is or whether it is already being exploited. As of 9 November 2026 there is no entry for it in the NVD, WPScan or Patchstack. What is clear is which versions are affected and which version to update to, and that is enough to act on today.

What is known about the issue

The WooCommerce advisory is short. It says only that the issue lies in the subscriptions functionality bundled with WooPayments and that the fix extends the one from August. It gives no technical details and no severity, so we do not guess at them either.

The August advisory, dated 5 August 2026, covers the separate paid extension WooCommerce Subscriptions. WooCommerce announced several vulnerabilities fixed in version 9.1.0 and wrote that the most serious of them could let an unauthorised user take control of the site. In the CVE database, a vulnerability in WooCommerce Subscriptions before 9.1.0 is recorded as CVE-2026-18391, and CISA scores it 9.8 on CVSS. WooCommerce does not say whether the November fix in WooPayments closes the same problem or a related one, so do not carry that score over to WooPayments. The CVSS score guide explains what a score like that means.

Which stores are affected

Any store running WooPayments on a version in the table below that has not yet received its fix is affected. The advisory does not limit the issue to stores that sell subscriptions. Having no subscription products does not make your store safe.

According to the WooCommerce documentation, up to version 10.2.0 WooPayments offered built-in subscriptions that did not need the WooCommerce Subscriptions extension, and that feature has since been removed. The subscriptions code still ships with the plugin, though. We checked the files of version 11.2.0 in the wordpress.org repository, and the includes/subscriptions and vendor/woocommerce/subscriptions-core folders are there. The fixed versions in the table include releases after 10.2.0, so the issue is not confined to the removed feature.

WooPayments is available to businesses and individuals in Bulgaria, and wordpress.org lists more than 800,000 active installations. If your store takes cards, Apple Pay or Google Pay through WooPayments, check the version today. A deactivated plugin is normally not loaded, but while the details are unknown it is safer to update it or delete it as well.

Is your store affected?

In wp-admin, open Plugins > Installed Plugins, find WooPayments and look at the version under its name. WooCommerce advises checking it even if automatic updates are on or your host manages updates for you.

In cPanel's Terminal, the command below shows the WooPayments version and whether the plugin is active. The WP-CLI guide explains how to work with WP-CLI.

Bash
# cPanel > Terminal, in the site's folder
# Read-only. Shows the WooPayments version.
wp plugin list --fields=name,status,version \
  --skip-plugins --skip-themes | grep woocommerce-payments

Staging and development copies often sit in the same account and are easy to forget. The next command looks for WooPayments in every folder of the account and reads the version from the plugin file without starting WordPress.

Bash
# cPanel > Terminal
# Read-only. The WooPayments version in every copy in the account.
find ~ -path "*/plugins/woocommerce-payments/woocommerce-payments.php" \
  -exec grep -H "^ \* Version:" {} \; 2>/dev/null

Each line of the output is one copy of the plugin, with its path and its version. Compare every version with the table.

Which versions fix the issue

Find your version in the left column. If you are already on the version in the right column, or on a later one in the same branch, you have the fix and do not need to update again.

Your versionUpdate to
11.2.011.2.1
11.1.011.1.1
11.0.0 and 11.0.111.0.2
10.9.010.9.1
10.8.010.8.1
10.7.0 and 10.7.110.7.2
10.6.010.6.1
10.5.0 and 10.5.110.5.2
10.4.010.4.1
10.3.0 and 10.3.110.3.2
10.2.010.2.1
10.1.0 and 10.1.110.1.2
10.0.010.0.1
9.9.09.9.1
9.8.09.8.1
9.7.09.7.1
9.6.09.6.1
9.5.09.5.1
9.4.09.4.1
9.3.09.3.1
9.2.0 and 9.2.19.2.2
9.1.09.1.1
9.0.09.0.1
Older than 9.0.011.2.1

Versions before 9.0.0 have no fix of their own, and WooCommerce recommends going straight to 11.2.1. According to the plugin file, that version requires WooCommerce 7.6 or later and PHP 7.4 or later. A jump from that far back is a big one, so try it on a staging copy first.

What to do

  1. Back up the files and the database, as described in the backup guide.
  2. Update WooPayments. The Update now link under Plugins > Installed Plugins installs the newest version, 11.2.1. If your store needs to stay on its branch, for example because another plugin does not work with the newer version yet, install the fix for your branch with WP-CLI, using the command below. The guide to updating plugins shows how to update without breaking the store.
  3. Check the version again, as WooCommerce advises. Then open the checkout page and make sure the card payment form loads.
  4. Update every staging and development copy too. WooCommerce specifically mentions copies that can be reached from the internet. Delete any copy you no longer need.
  5. If you also use the WooCommerce Subscriptions extension, make sure it is on 9.1.0 or later because of the August fix.
  6. If the update does not show up or fails with an error, contact WooCommerce Support and include your WooPayments version and the error you see.

The command below updates WooPayments to exactly the fix for the 10.5 branch. Replace the number with the version from the table for your branch. If something stops working after the update, restore the backup from step 1.

Bash
# cPanel > Terminal, in the site's folder
# Changes the site. Updates WooPayments to the fix for the 10.5 branch.
wp plugin update woocommerce-payments --version=10.5.2

What we do

With vulnerability (CVE) monitoring we track what is installed on your site and match it against the vulnerability (CVE) databases every day. As soon as a vulnerability appears in something you use, we send you an alert and update, trying the update on a copy in staging first. Your site can be hosted anywhere. If you would like us to add your store, write to us through the inquiry form.

Frequently asked questions

What does the WooPayments update of 3 November 2026 fix?

It fixes a security issue in the subscriptions code bundled with the WooPayments plugin. According to WooCommerce, it extends the subscriptions security update of August 2026. WooCommerce has published no technical details, severity or CVE number, and as of 9 November 2026 there is no entry in the NVD, WPScan or Patchstack either.

Is my store affected if I do not sell subscriptions?

It may be. The WooCommerce advisory applies to every store running WooPayments on an affected version and makes no exception for stores without subscriptions. The subscriptions code still ships with the plugin in version 11.2.0, so check and update WooPayments even if you have no subscription products.

Which WooPayments version fixes the issue?

The newest is WooPayments 11.2.1, and every branch has its own fix, for example 11.1.1, 11.0.2, 10.9.1, 10.5.2, 10.2.1, 10.0.1 and 9.0.1. A store already on the fix for its branch, or on a later version in it, does not need to update again. The full table is in the WooCommerce advisory of 3 November 2026.

What should I do if WooPayments is older than 9.0.0?

WooPayments versions before 9.0.0 have no separate fix, and WooCommerce recommends updating straight to 11.2.1. That version requires WooCommerce 7.6 or later and PHP 7.4 or later. Back up first and try the jump on a staging copy.

How do I check which WooPayments version is installed?

In wp-admin, open Plugins > Installed Plugins and look at the version under WooPayments. In cPanel's Terminal, wp plugin list --fields=name,status,version run in the site's folder shows the version and changes nothing. The plugin is listed there as woocommerce-payments.

Do I need to check the version if automatic updates are on?

Yes. WooCommerce advises checking the WooPayments version even if automatic updates are enabled or your host manages updates for you. If the store is already on a fixed version, there is no need to update again.

Do staging and development copies need the update too?

Yes. WooCommerce specifically asks you to check WooPayments on every site, including staging and development copies that can be reached from the internet. Updating the live store does not update its copies. Delete any copy you no longer need and put the rest behind a password.

Sources

# TagsSecurityWooCommerce
ShareFacebookXLinkedIn
Checkout Files Upload for WooCommerce lets anyone upload PHPContact Form 7 flaw lets anyone upload files without loginWhat does the HTTP2Shell flaw mean for WordPress sites?

A cookie for statistics

We use one cookie for our own statistics and to see which visits lead to an order, only if you accept it. It is not used for advertising. Controller: Private DevOps LTD. Cookie policy