WooCommerce 11.2.0 shipped on October 7, 2026. It contains five security fixes, and WooCommerce’s own release notes are unusually direct about it: “Update all stores to 11.2.”
That’s the easy part. The part worth slowing down for is this: on sites running a specific other plugin, installing 11.2 takes the store offline with a fatal error.
Check PublishPress Future first
If the site runs PublishPress Future on any version from 3.0.0 through 4.10.3, updating WooCommerce to 11.2 causes a fatal error.
The cause is mundane and familiar. PublishPress Future loads its own outdated copy of Action Scheduler instead of using the one bundled with WooCommerce. Two plugins, both working fine on their own, loading two incompatible versions of the same library into one request.
PublishPress fixed it in 4.10.4. The order matters:
Update PublishPress Future to 4.10.4 or later
Then update WooCommerce
Reverse that order and the site is down until someone reaches it over SFTP. If you read our piece on the Elementor 4.3 outage, this is the same failure mode wearing different clothes — not a bug in either plugin, but a collision between them.
What the five security fixes actually cover
None of these is an unauthenticated remote code execution. They are privilege escalation and information disclosure hardening — the kind of flaw that needs a foot already in the door, or an administrator who configured something reasonable that turned out not to be.
| Area | What changed |
|---|---|
| Cc/Bcc | Cc and Bcc recipients can no longer be set on the Reset Password, New Account and Confirm Email Address emails. Previously saved addresses are now ignored. |
| Downloads | Downloadable-product authorization now rejects malformed order and email credentials before the permission lookup runs. |
| Shop managers | Shop managers can no longer edit users who also hold a more privileged role outside the editable-roles list. |
| Blueprints | On multisite, importing Blueprints now requires network super admin rights. Subsite administrators cannot. |
| Usage tracking | WooCommerce now verifies that sensitive information is excluded from opt-in tracking data. |
The Cc/Bcc change is the one most likely to have affected a real store. Those three emails contain password reset and verification links. Anyone who added a shared inbox or a team address as Bcc — a perfectly sensible-looking thing to do — was quietly forwarding account access to whoever could read that mailbox. It was never a vulnerability in the exploit sense. It was a setting that should never have existed.
This release updates the database
11.2.0 is backwards compatible, but it carries a database update. That raises the stakes on two things:
Back up first, and have somewhere to restore to. A schema change is not something you undo by reinstalling the previous version.
Let the upgrade finish. WooCommerce queues the database update through Action Scheduler and runs it in the background. Triggering it is not the same as completing it. Check WooCommerce → Status → Scheduled Actions afterwards and confirm nothing is stuck as pending or failed. On a store with a large order table this takes longer than people expect.
For any shop with real revenue, this one belongs on staging before it goes near production.
Test a download after updating
The downloads fix is the only change with a realistic chance of breaking something that currently works. WooCommerce notes that rare custom or imported download links, and permission records holding malformed order or email data, may stop functioning.
If the store sells digital products, buy one yourself after the update and download it. If a link is broken, the fixes are straightforward: reissue the link, repair the permission record, or correct the order’s billing email and regenerate permissions. Note that regenerating resets download counts and logs.
The pattern underneath
Count the WooCommerce security releases since mid-August: 11.0.1, 11.1.1, 11.1.2, and now 11.2.0. Four in roughly eight weeks.
WordPress core is running at the same pace — 7.1.3 was the third security release in nineteen days.
A store owner updating by hand is now being asked to read release notes, catch plugin conflicts buried in an advisory section, stage a database migration and verify a checkout — roughly every two weeks, indefinitely. That is not a reasonable expectation of someone whose job is selling things.
It is, however, exactly the job.
What we do with releases like this one
WooCommerce maintenance is $89/month. For a release like 11.2 that means: we read the advisories before touching anything, resolve the PublishPress ordering, stage the update, let the database migration complete and verify it, then test checkout and a live download before it reaches production.
Standard WordPress sites without a shop are $69/month.
If you’d rather not spend your Tuesday reading changelogs, get in touch. Phone, email or live chat — whichever is fastest.
Sources: WooCommerce 11.2.0 release notes, full changelog
