WooCommerce 10.7.0 technical update
Released on , WooCommerce 10.7.0 ships with security fixes, a database update, and backwards compatible changes across performance, analytics, blocks, and APIs. Read the release announcement on WooCommerce Developer Blog.
This version includes 175 merged pull requests from 66 contributors, with the current stable tag set to WooCommerce 10.7.0.
A database update is included, so schedule the upgrade for a maintenance window where you can run updates promptly and validate critical flows such as checkout, refunds, and order management.
Performance enhancements and cache priming
10.7 focuses heavily on query reduction, with tangible wins for REST API, checkout persistence, shipping zone method lookups, and Store API product responses.
HPOS orders: REST API cache priming removes N+1 patterns
For HPOS sites, cache priming now preloads order data before REST API serialisation, reducing N+1 query patterns on /wc/v4/orders. The reported baseline of 271 database queries per request drops to 132, a 51% reduction.
This change is most relevant for headless builds, integrations polling orders, and high-volume back office tooling where REST API throughput becomes a bottleneck.
Checkout: fewer queries when persisting draft orders
Draft order persistence during checkout has been optimised to reduce SQL query volume. Without object caching, typical query counts move from roughly 204 down to around 172; with object cache enabled, the reduction is more pronounced, with figures moving from about 127 to as low as 115.
This is especially meaningful for stores with high concurrent sessions, where draft order churn amplifies database load.
Shipping: new indexes for zone method lookups
New indexes have been added on woocommerce_shipping_zone_methods for (zone_id, method_id), improving query efficiency when calculating and managing shipping methods, particularly on stores with many zones and complex configurations.
Store API: cached Last-Modified on products endpoint
The Store API products endpoint now caches the Last-Modified timestamp so that, on a cache hit, the database query can be skipped. This improves response time and reduces load for storefronts and apps relying on conditional requests.
Control order count refreshes under load
A new woocommerce_pre_refresh_order_count_cache filter allows extensions to short-circuit redundant order count refreshes when the cache is managed externally. This is useful for large stores using bespoke caching strategies or externalised analytics pipelines.
Experimental block-based email editor improvements
The block-based email editor remains gated behind a WooCommerce feature flag, but 10.7 improves rendering, performance, and customisation hooks.
WordPress embed blocks now render as rich cards including featured image, title, excerpt, and site icon, rather than plain links. To keep emails performant, cards are capped at five per email and cached using a transient with a one-day TTL.
CSS inlining has been consolidated into a single pass to reduce redundant processing, and new filters have been added for template HTML customisation and send button behaviour in auto-save workflows.
Analytics export filters and multicurrency correctness
Analytics exports now forward currency context and custom filter parameters from the UI into background export jobs. Previously, exports could diverge from what merchants saw in the interface, particularly in multicurrency setups where currency context was lost.
New hooks enable report-specific export column and row customisation, allowing extensions to add fields while keeping exports aligned with applied filters.
Accessibility improvements
Colour contrast has been improved across key admin and checkout surfaces. System Status indicators now meet WCAG 2.2 AA contrast requirements, with additional contrast fixes in the dashboard widget and checkout elements.
The shortcode checkout validated field border now uses the updated --wc-green variable and var(--wc-subtext), improving clarity across themes.
Cart and Checkout block fixes
The cart nonce is now fetched freshly during cart store initialisation and awaited before POST operations, tightening reliability for state-changing requests.
The payment method radio control is now always rendered, even when only one payment method is available. Previously, hiding the radio caused the payment label and description to visually merge, increasing checkout friction.
Dark mode form element colour inheritance has also been corrected to prevent low-contrast inputs and inconsistent UI states.
Fulfilments API (Beta): typed tracking and extensible providers
Fulfilments remains a beta feature, but 10.7 introduces a more complete API surface for tracking data and provider management. Typed PHP methods are available for reading and writing tracking numbers and shipping providers, and a dedicated order note group constant has been introduced for fulfilment-related notes.
The fulfilments data store is now registered via the woocommerce_data_stores filter, enabling extensions to override storage where needed. The fulfilments namespace has also moved to Automattic\WooCommerce\Admin\Features\Fulfillments, so custom code should be checked for hard-coded class references.
Custom shipping providers can now be defined in settings under Shipping Providers, backed by a new wc_fulfillment_shipping_provider taxonomy. Providers support tracking URL templates, and the orders list gains filtering by provider, improving fulfilment operations for multi-carrier stores.
API updates affecting integrations
Customer username and password fields are now always optional and will be auto-generated when empty, which can simplify onboarding flows but may affect integrations that previously relied on validation errors for missing credentials.
Refund amount comparison now uses proper precision rounding, preventing false failures where the system reports that the refund amount cannot be less than line items due to floating point rounding discrepancies.
Security and database notes
This release includes security hardening across multiple surfaces. XSS protection using wp_kses_post() has been extended to the v4 REST API order notes creation endpoint, aligning behaviour with v1 through v3.
CSRF validation via check_ajax_referer() has been added to the product_ordering() and term_ordering() AJAX handlers, tightening request validation around ordering actions.
Payment gateway password fields now use trim() rather than sanitize_text_field(), preserving % characters that were previously stripped, which can be significant for gateways using encoded secrets.
A database update is included, and the update routine wc_update_1070_disable_hpos_sync_on_read has been deprecated. Treat this as a prompt to re-check any operational assumptions around HPOS sync behaviour in custom tooling.
FAQ
Does WooCommerce 10.7.0 include a database update?
Yes. WooCommerce 10.7.0 includes a database update, so you should plan for an upgrade window, run the database updater, and verify key store operations afterwards.
Is WooCommerce 10.7.0 backwards compatible?
Yes, it is marked as backwards compatible, but you should still test extensions that touch fulfilments classes, checkout persistence, REST API order serialisation, and gateway credential handling.
What is the biggest performance gain in WooCommerce 10.7?
The most significant reported win is HPOS REST API cache priming on /wc/v4/orders, reducing database queries from 271 to 132 per request by eliminating N+1 query patterns during serialisation.
How does 10.7 improve Analytics exports for multicurrency stores?
Exports now forward currency context and custom filter parameters from the UI into the background export job, so exported data matches what is shown in the Analytics interface for the selected currency and filters.
What changed in the Cart and Checkout blocks?
The cart nonce is fetched and awaited before POST operations to improve request reliability, and the payment method radio is always displayed even when only one method exists to prevent confusing visual merging of labels and descriptions.
Where can I read the official 10.7 release post?
You can read the full release announcement at WooCommerce 10.7: Performance, Analytics, and a better Store API.
