Web Development
WooCommerce 11.3 and the PHP Security Fix: What Store Owners Must Check Before Black Friday
October 2026 has been busy for WooCommerce store owners. A critical PHP security release landed on October 21, WooCommerce 11.2.1 fixed two checkout bugs, and WooCommerce 11.3 is removing an old AI endpoint while testing new agent features. With Black Friday on November 27 and Cyber Monday on November 30, this is the last comfortable window to get your store in shape.
This guide pulls it all together in one place, with a checklist at the end you can work through in an afternoon.
1. The PHP security release comes first
On October 21, the PHP project fixed two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619, which can allow remote code execution on any PHP server. WooCommerce’s developer team was clear: the issue is in PHP, not in WooCommerce or WordPress, so no WooCommerce update is required or planned. You need to update PHP.
Key points for stores:
- Stores on WordPress.com, WordPress VIP, Pressable and WP Cloud were already protected.
- Other hosts may be patching and adding firewall rules, but you should confirm with them.
- PHP versions before 8.2 no longer get security updates.
- WooCommerce now recommends PHP 8.3 or newer. The minimum is still PHP 7.4, but that will rise in future releases.
- If you run an old self managed server and cannot upgrade quickly, several national cyber security agencies recommend taking it offline while you fix it.
Check your version under Tools, Site Health, Info, Server. Our full PHP security update guide explains what to do on each hosting type.
2. WooCommerce 11.2.1 fixed checkout problems
WooCommerce 11.2.1, released on October 9, fixed two issues worth knowing about:
- Classic checkout was broken for stores that removed address fields with filters. If you trimmed your checkout to fewer fields, for example for digital products, this affected you.
- Postcode validation in the Checkout block was failing for Argentina and some other countries.
If you are still on 11.2.0, update. Checkout bugs are the most expensive kind of bug during a sale.
3. WooCommerce 11.3 removes the old MCP endpoint
WooCommerce 11.3 removes its deprecated MCP endpoint. Any request to /wp-json/woocommerce/mcp now returns a 410 Gone error. MCP is the protocol AI assistants like Claude and ChatGPT use to connect to software.
Most stores never used this endpoint. But if you or your developer experimented with connecting an AI assistant to your store this year, check whether it used that address. If it did, it will stop working after the update.
4. Extensible abilities: WooCommerce’s new agent API
In its place, WooCommerce 11.3 adds an experimental extensible abilities API. It is off by default and can be switched on under WooCommerce, Settings, Advanced, Features. The idea is that WooCommerce and its extensions can describe what they can do (look up an order, update stock, create a coupon) in a standard way that AI agents can use through WordPress’s Abilities API and the MCP Adapter.
Our advice: do not switch this on in a live store before Black Friday. Test it on staging if you are curious. It is the foundation for AI tools that could run parts of your store later, but it is experimental for now. We wrote more about the bigger picture in WordPress and AI agents.
5. Other ecosystem news
- Development of the Purple theme moved into the WooCommerce monorepo, as the first theme in a new themes directory.
- WordPress 7.2 Beta 1 arrived on October 20, with the final release on December 8. Do not update a busy store to 7.2 during the holiday season. See our WordPress 7.2 Beta 1 guide.
- The October Shopify app security incidents are a reminder that WooCommerce stores face the same risk from plugins that load outside scripts. Review what runs on your checkout page.
Your pre Black Friday WooCommerce checklist
Security
- Confirm PHP is patched, ideally on 8.3 or newer.
- Update WordPress core, WooCommerce and all plugins after a full backup.
- Remove plugins you no longer use.
- Turn on two factor authentication for every admin and shop manager.
- Check that your payment gateway plugin is current.
Checkout
- Place test orders on desktop and mobile, with cards and wallets.
- Test coupons, free shipping thresholds and gift cards.
- Check postcode and address validation for every country you ship to.
- Make sure order emails arrive and do not land in spam.
Performance
- Run a speed test on your home page, a category page and a product page.
- Check that caching is not caching the cart or checkout.
- Ask your host whether your plan can handle a traffic spike. Our guide to speeding up WordPress has quick wins.
Freeze
- Set a code freeze from around November 20 to December 2. No new plugins, no theme changes, no major updates unless they are security fixes.
Plan for the day itself
Preparation is half the job. The other half is knowing what to do when something goes wrong at 9am on Black Friday. Write these down before the day:
- Who is on call, with phone numbers, for the site, the host and the payment gateway.
- How to switch to a backup payment method if your main gateway has an outage.
- How to put up a short maintenance notice without taking the whole store down.
- Where your latest backup is and how long a restore takes.
- Which discount codes are live and when they expire, so support can answer quickly.
Stores that have this written down recover in minutes. Stores that do not tend to lose hours, and those hours are the most valuable of the year.
What this means in the US, UK and Australia
United States: Black Friday and Cyber Monday are the biggest sales days of the year for most US stores. A checkout outage on November 27 can wipe out a month’s profit. Patch now and freeze changes early.
United Kingdom: UK shoppers have fully adopted Black Friday, and many retailers run a full “Black November”. If you take card payments, make sure 3D Secure is working smoothly in your gateway, since failed authentication causes abandoned checkouts. Test UK postcodes thoroughly, as formatting issues are common.
Australia: Black Friday is now one of Australia’s biggest shopping events, and Click Frenzy and Boxing Day follow close behind. Test Australian postcode validation and GST display, and confirm that your shipping plugin returns correct rates for regional areas.
Quick wins that lift holiday sales
Once the technical checks are done, a few small changes can make a real difference to conversion during the sale:
- Show delivery cut off dates for Christmas on product and cart pages.
- Enable express wallets such as Apple Pay, Google Pay and PayPal, which cut checkout time on mobile.
- Make the free shipping threshold visible in the cart, with a message showing how much more the customer needs to spend.
- Add a clear returns summary near the Add to Cart button. Gift buyers check returns more than anyone.
Sources
Need a hand with this on your own site? See our WordPress development and Shopify development services.
Frequently asked questions
Do I need to update WooCommerce for the PHP vulnerability?
No. Update PHP. WooCommerce says no WooCommerce update is required.
Which PHP version does WooCommerce recommend?
PHP 8.3 or newer. The current minimum is 7.4, but versions before 8.2 no longer get security fixes.
Should I enable extensible abilities in WooCommerce 11.3?
Not on a live store yet. It is experimental. Test it on staging.
Can Web Brick Studio prepare my WooCommerce store for Black Friday?
Yes. We patch PHP and plugins, test checkout, speed up your store and stay on call during the sale. Contact us.
