WooCommerce 11.1.2: Review Moderation and Gallery Fixes

WooCommerce confirms there is no database update with this release. It lands four days after WooCommerce 11.1.1, making it the second patch on the 11.1 branch in a week, and the release note itself runs to two lines. The detail sits in the linked pull requests and in one unusually thorough bug report, and it is more consequential than the length of the note suggests.

The two fixes affect different stores. The gallery fix matters to any store selling variable products, because the code behind it has been switched on for every store since WooCommerce 11.1 made variation galleries native. The review fix only matters to stores that have opted in to WooCommerce's Customer Review Request beta, but for those stores it closes a gap in how customer reviews reached the product page.

How it works

Since 11.1.0, the function that assembles the data for each variation of a variable product also builds that variation's gallery, and it does so by rendering the theme's full product image template. The bug report behind the fix explains why that is fragile. Themes and extensions routinely ask for a product's variations (sale badges, price ranges, colour swatches and product feeds all do it), and if anything running while the image template renders asks for the variations again, the two pieces of code call each other until PHP hits its time limit and the request fails. In 11.0.1 the same code sat behind a feature check, so the loop only became reachable on every store when 11.1.0 switched galleries on.

Pull request 68939 adds the missing guard: the gallery HTML can now only be output once per product. Normal gallery hooks still fire, and only a recursive attempt to render the same product's gallery is skipped, so themes that never triggered the loop see no change. The developer who wrote the fix noted that the scope where the loop can happen seems narrow but the consequences are bad, and argued that alone justified a patch release.

The review fix concerns a newer feature. WooCommerce has been building a native Customer Review Request since version 10.8. Once enabled, it emails customers a set number of days after their order is marked complete and links them to a Review Order page where they can rate each item they bought. The feature ships switched off, as a beta under WooCommerce > Settings > Advanced > Features, with the email itself configured under WooCommerce > Settings > Emails. Pull request 68961 changes how that page saves what customers submit. Reviews are now created through WordPress's standard comment pipeline, so they receive the same content filtering, moderation and spam checks as any other comment and follow the rules set under Settings > Discussion, including manual approval and the disallowed keys list. The same change brings review creation through the older v1 and v2 REST API endpoints into line with the current v3 endpoint.

Examples and use cases

The bug report is specific about the combination that brought one store down. The Flatsome theme (version 3.20.9) prints its sale badge inside its own override of the product image template, and in percentage mode that badge looks up the product's variations to find the largest discount. With the Iconic WooThumbs plugin (version 5.13.2) installed, every variation reports the parent product's gallery. Together, every variable product on sale triggered the loop. On a store with 4,400 products and 30,000 variations, every category page returned an HTTP 500 error after 30 seconds from the minute 11.1.0 was installed, with each request making about 3,300 nested gallery renders and 3.6 million object-cache reads before PHP gave up.

The wider lesson is in how that failure presents. Neither the theme nor the gallery plugin is faulty on its own, and in this case the loop was triggered by on-sale products, so a store could pass a post-update check one week and fall over when a promotion started the next. Category pages, which list many products at once, are where it bites hardest. The report was filed on 5 September and the fix shipped on 22 September, so a store that hit it had 17 days of living with a rollback or a workaround.

For the review feature, picture a store that switched the beta on to build up reviews ahead of Christmas trading, with Settings > Discussion set so that every comment needs manual approval. That setting governs the review form on the product page. Before 11.1.2, submissions from the Review Order page did not go through the same pipeline, so the store owner could not assume the setting also covered reviews arriving from the email. After the patch, one moderation policy covers both routes.

What this means for UK merchants

For most UK stores this is a patch to apply this week rather than one to schedule for later. There is no database update, both fixes are narrow, and the gallery guard only changes behaviour when a loop would otherwise occur. Stores running a theme that overrides the product image template, Flatsome included, and stores using a variation image plugin alongside native galleries have the strongest reason to move promptly. After updating, browse a category page that contains an on-sale variable product and confirm it loads. Keeping a store patched and checked on this kind of cadence is what our WordPress maintenance service is for.

The review change has a UK compliance angle that goes beyond tidiness. Since April 2025, fake reviews and concealed incentivised reviews have been banned practices under UK consumer law, and the CMA's short guide for businesses publishing consumer reviews says any trader that publishes reviews must take reasonable and proportionate steps to prevent and remove them, with its own procedures to detect, investigate and act on banned content. The guide also says the risk assessment behind those procedures should be revisited when a business changes the way it operates in a way that might raise the risk. Switching on a new channel that invites reviews by email is that kind of change. 11.1.2 means a store's existing moderation settings now reach the Review Order page. It does not write the published review policy the CMA expects every publisher to have.

The review request email deserves the same care. Merchants can edit its copy, and adding a discount code for leaving a review makes the resulting reviews incentivised, which the CMA guidance says must never be concealed. Star ratings also feed what shoppers see in search results, so the ratings data behind them matters as much as the moderation, and stores leaning on reviews for organic visibility should treat it as part of their WooCommerce SEO rather than a side feature.

Practical considerations

11.1.2 does not fix everything in the review beta. A separate bug, fixed in pull request 69060 on 25 September, means an approved review submitted or edited on the Review Order page is left out of the product's stored average rating and rating count, although the review count is correct. That fix is scheduled for WooCommerce 11.2.0, with release week set for 6 October in the 11.2 pre-release notes, and has not been backported to 11.1. It matters beyond the product page. WooCommerce builds a product's AggregateRating structured data from those stored figures and only outputs it when the rating count is above zero, so a product whose only star ratings came through the Review Order page can end up with no rating in the markup Google reads for review snippets. Stores counting on the beta for their first reviews may prefer to wait for 11.2 before promoting it.

The usual caution applies to the update itself. One commenter on the release note reported a critical error on updating, which cleared after reinstalling the plugin, and WooCommerce has not published a known issue about it. WooCommerce also does not say which fix earned the security flag, though the review change is the only one described as tightening validation. Take a backup, apply on staging where one exists, and keep the rollback steps in the official WooCommerce update guide to hand.

FAQ