What changed: WooCommerce overhauled its security process after HackerOne reports rose roughly nine-fold: in July it ran an AI-assisted review across a year of past releases, August scans across the monorepo and extensions flagged roughly 700 potential issues, every trunk merge since August gets an automated security scan (34 issues surfaced, 18 valid, about a 77% valid rate), and in October it enrolled in Anthropic's OSS Scanner program (roughly 200 findings, about 90% valid in the platform software, fixes shipping in 11.2.2 and 11.3.1). Critical/High fixes now ship in the next patch release on the current version, while Medium/Low fixes ship in the patch release after the next minor version. Starting with WooCommerce 11.2, WooCommerce.com can mark an extension's security release as required, so connected stores with an active subscription install it on their next update check, usually within a day, even with auto-updates off.
Who is affected
The source says this covers store owners connected to WooCommerce.com with an active subscription, extension developers, and store operators running PHP 7.4 or 8.0.
What it means for your business
For businesses using WooCommerce, this means required extension security fixes can now reach their store automatically, but only if the store stays connected to WooCommerce.com with an active subscription.
What to do
Keep WooCommerce, extensions, and WordPress updated, and verify the installed version after a security release even if auto-updates are on. Buy extensions through the WooCommerce Marketplace and keep your store connected to WooCommerce.com with an active subscription. Move hosting to PHP 8.1 or newer, ideally 8.3 or newer, and plan an upgrade with your host if you're still on PHP 7.4 or 8.0.
When it takes effect
Required security updates have been installing automatically since WooCommerce 11.2; WooCommerce 11.6 (February 2027) will require PHP 8.1 or newer, with 11.5 the last release supporting PHP 7.4/8.0.
Source: https://developer.woocommerce.com/2026/11/06/woo-latest-security/
