WooCommerce has just announced it has patched a critical vulnerability affecting millions of users. Publishers using the WooCommerce plugin or the WooCommerce Blocks plugin are strongly urged to update their plugins if they have not already automatically updated.
"On July 13, 2021, a critical vulnerability concerning WooCommerce and the WooCommerce Blocks feature plugin was identified and responsibly disclosed by security researcher Josh via our HackerOne security program. |
Upon learning about the issue, our team immediately conducted a thorough investigation, audited all related codebases, and created a patch to fix the issue for every impacted version (90+ releases), which was deployed automatically to vulnerable stores."
After updating to a patched version, the company also recommends:
- Updating the passwords for any Admin users on your site, especially if they reuse the same passwords on multiple websites
- Rotating any Payment Gateway and WooCommerce API keys used on your site.
If your website didn't get the automatic update, That could be for a number of reasons, a few of the most likely are: you're running a version prior to one impacted (below WooCommerce 3.3), automatic updates have been explicitly disabled on your site, your filesystem is read-only, or there are potentially conflicting extensions preventing the update. In all cases (except the first example, where you are unaffected), you should attempt to manually update to the newest patched version on your release branch (e.g. 5.5.1, 5.4.2, 5.3.1, etc.)