WooCommerce 11.2: Security Fixes and Withdrawal Emails

The release merges 642 pull requests from 93 contributors, is backwards compatible and includes a database update. The new features are practical: a product CSV importer that can match rows on barcodes, date fields for the checkout, more styling options on store blocks, and configurable emails for the order withdrawal form that arrived in WooCommerce 11.1. The reason to act this week is the security section: five fixes, covering password reset emails, downloads, shop manager permissions, multisite imports and usage tracking, none of them given a severity rating.

There are also edges to check first. Older versions of PublishPress Future, a widely used scheduling plugin, can cause a fatal error once 11.2 is installed, and smaller behaviour changes touch coupons, checkout layouts and imports. Stores with custom code or custom styling are the ones that most need a staging test.

How it works

The security fixes first, in plain English:

• Password reset and verification emails no longer accept Cc or Bcc. WooCommerce lets a store copy its emails to extra addresses. On the Reset password, New account and Confirm email address emails, that meant a password reset or verification link could reach someone other than the customer. Those three emails, and the Back in Stock sign-up verification email, now go to the customer only, and Cc or Bcc addresses saved on them earlier are ignored.
• Download links are checked more strictly. Links carrying malformed order or email values are now rejected before WooCommerce looks up the download permission. Links that WooCommerce generates itself are unchanged.
• Shop managers can no longer edit more privileged users. The Shop manager role can edit customer accounts. Until now, a user who also held a role outside the list shop managers may edit, such as a forum or membership role, could still be edited by a shop manager depending on the order the roles were added. Any such extra role now puts the account out of reach. Administrators are unaffected.
• Blueprint imports on multisite need a super admin. Blueprints are WooCommerce's tool for exporting and importing store settings. Some import steps change settings that reach beyond a single site, so on a multisite network only network super admins can now import them. Single-site stores are unaffected.
• Usage tracking sends less. For stores opted in to usage tracking, page addresses sent with analytics events now keep only attribution parameters such as utm_source and drop the rest.

The withdrawal emails build on WooCommerce 11.1, which added an order withdrawal form for stores that need to conform to EU consumer rules. The feature is off by default and is switched on under WooCommerce > Settings > Features. A customer then submits a withdrawal request from My Account, the request is logged, and emails go out. In 11.2 those emails join the standard list under WooCommerce > Settings > Emails, one acknowledging the customer and one notifying the merchant, each with the usual controls for recipients, additional content, previews and whether it is sent. Processing the withdrawal and any refund is still manual.

The product CSV importer gets the most useful merchant-facing change. With "Update existing products" ticked, a row with no ID or SKU can now be matched to an existing product by its GTIN, UPC, EAN or ISBN, with matching tried by ID, then SKU, then that global unique ID. A non-blank identifier that matches nothing now skips the row rather than creating a new product, and a match against a product of a different type is refused. Clean-up has changed too. It used to run site-wide deletes of orphaned variations, metadata and term relationships, which WooCommerce says added over a minute to small imports on large catalogues and could remove unrelated data. It now removes only the placeholder products the import itself created.

Finally, the Additional Checkout Fields API, which extensions use to add fields to the Checkout block, now supports dates. Shoppers get their browser's native date picker, while emails and order details show the date in the site's own date format, and developers can restrict the range relative to today. It is a developer API rather than a settings screen, so using it needs a supporting extension or some custom code.

Examples and use cases

Consider a retailer that refreshes stock and prices from a supplier spreadsheet. The supplier's file carries barcodes but not the store's own SKUs, so before 11.2 the importer had nothing to match on, and an update run could create a duplicate product for every row. With 11.2 and "Update existing products" ticked, the same file matches on EAN, and a barcode that matches nothing is skipped rather than added.

A florist, bakery or furniture shop that asks customers to choose a delivery date is the obvious fit for the checkout date field. WooCommerce's own example is a preferred delivery date from tomorrow through the next 30 days. Because the date then appears in the site's own format in order emails and the admin, a UK store set to day-first dates gets day-first dates on every order, whatever browser the customer used.

The Cc and Bcc fix has a realistic case behind it. A developer or agency who set a Bcc on every store email to watch deliverability would, until now, have been receiving copies of customers' password reset links, which is a risk if that mailbox is ever compromised. The download change mostly affects stores that migrated from another platform: rare custom or imported links with malformed data may stop working, and the store can reissue them from the order. The shop manager change matters on stores that also run a forum or membership plugin, where accounts often carry more than one role.

What this means for UK merchants

Update, but test first. WooCommerce's instruction is to update all stores to 11.2, and for businesses holding or working towards Cyber Essentials the timing is not just good practice. The scheme's Requirements for IT Infrastructure v3.3 ask for updates to be installed within 14 days of release where they fix vulnerabilities rated critical or high risk, and also where the vendor gives no details of the severity. The 11.2 release note rates none of its security fixes, so on that wording the deadline is 21 October where the website is in scope. Check with your certification body how your website is scoped.

The withdrawal emails deserve more care than a quick look at the settings screen suggests. WooCommerce describes the withdrawal form as a feature for EU consumer rules, but UK shoppers have a parallel right. Under the Consumer Contracts Regulations 2013, a consumer can cancel most online sales of goods until 14 days after the goods arrive. Regulation 32 then says that if a trader offers a cancellation form on its website, the consumer does not have to use it, but if they do, the trader "must communicate to the consumer an acknowledgement of receipt of the cancellation on a durable medium without delay". Email counts as a durable medium under the regulations' definitions.

So for a UK store with the withdrawal form switched on, the customer acknowledgement email is doing a legal job. In 11.2 it can be switched off from the settings screen, and WooCommerce's own testing notes confirm the request still goes through when it is. Leave it enabled unless something else sends that acknowledgement, and use the additional content field to explain what happens next, such as how to return the goods and when the refund follows. Under regulation 34, reimbursement is due within 14 days of receiving the goods back, or evidence they have been sent if that comes first. This is our reading of the regulations rather than legal advice, so check it against your own returns policy.

The importer change is the one many UK retailers will feel day to day, because barcodes are often the one identifier a supplier file and a store share. If catalogue updates still run on spreadsheets and manual fixes, it is worth reviewing how the store's product data is structured, which is part of how we approach ecommerce website development for UK businesses.

Update, 10 October 2026: WooCommerce released 11.2.1 on 9 October, so update straight to 11.2.1 rather than 11.2.0. It is not a security release and has no database update, but it fixes an 11.2.0 regression on the classic checkout: stores that remove address fields with a code snippet, such as the woocommerce_billing_fields filter, could see orders blocked with "Please enter an address to continue.", tax not charged, or shipping options disappearing.

Practical considerations

Check PublishPress Future before anything else. The release note warns that versions 3.0.0 to 4.10.3 can cause a fatal error on sites running WooCommerce 11.2, because they load their own outdated copy of Action Scheduler instead of the one bundled with WooCommerce. PublishPress fixed this in 4.10.4, and the WordPress.org plugin directory listed 4.10.7 at the time of writing. Update that plugin first, then WooCommerce, and take a full backup before the database update runs. The WooCommerce update guide covers the process.

Several smaller changes, listed in the 11.2 pre-release notes, are worth testing on staging:

• Coupons. With sequential discounts enabled, coupons of equal priority now apply in the order the customer entered them rather than lowest amount first, so cart totals can shift. A coupon's minimum spend can no longer be set above its maximum.
• Cart and Checkout block layout. The order summary becomes a fixed 360px column instead of 35 per cent, and the two-column layout now starts at 920px of container width rather than 700px. Custom CSS keyed to either old value will misalign.
• Classic product templates. Category lists on product pages now show parent categories first, so "Cameras, Electronics" becomes "Electronics, Cameras".
• Removed experiments. The experimental abandoned cart recovery and Agentic Checkout APIs, both off by default, are gone, and the database update cancels any queued recovery actions.

FAQ