WooCommerce published another Stripe for WooCommerce security update on August 6, 2026. The advisory identifies versions 9.7.0 through 10.8.4 as affected and says the most significant issue could make a store unavailable. This update is separate from the July 14 payment-validation patch, so stores that updated in July need to update again.
Use this for individual WooCommerce stores, agency fleets, managed hosts, multisite networks, and teams pinned to a supported Stripe maintenance branch.
Quick answer
Update to Stripe for WooCommerce 10.8.5 when compatible. If a store must stay on an older supported branch, use the patched version named by WooCommerce for that branch: 10.7.2, 10.6.3, 10.5.4, 10.4.1, 10.3.2, 10.2.1, 10.1.1, 10.0.2, 9.9.3, 9.8.2, or 9.7.2. Verify the active version on every site and run checkout tests after the update.
What to check first
- Export each site's active Stripe for WooCommerce version instead of relying on an auto-update policy or dashboard badge.
- Classify versions 9.7.0 through 10.8.4 as affected unless they match an official patched maintenance build.
- Choose 10.8.5 when compatible or the exact patched build for the site's supported branch.
- Update production, staging, development, multisite, and dormant public copies, then verify the loaded plugin version.
- Test store availability, guest and saved-card checkout, wallet methods, webhooks, refunds, and order notes.
Why this usually happens
- A recent security update can create false confidence when a separate issue is disclosed weeks later.
- Version pins and compatibility constraints can prevent a fleet from moving directly to the newest major or minor branch.
- Auto-update settings do not prove that downloads, activation, cache, and deployment completed.
Useful command or data shape
Adapt paths, IDs, and privacy handling to the site before running commands or storing data on production.
# Verify the active version on each site
wp plugin get woocommerce-gateway-stripe --fields=name,status,version,update,update_version
# Official fixed versions include:
# 10.8.5, 10.7.2, 10.6.3, 10.5.4, 10.4.1, 10.3.2
# 10.2.1, 10.1.1, 10.0.2, 9.9.3, 9.8.2, 9.7.2
Diagnostic table
Use this table to connect the observed behavior to evidence and a verification step.
| Action | Evidence to collect | How to verify |
|---|
| Export the version fleet | Export each site's active Stripe for WooCommerce version instead of relying on an auto-update policy or dashboard badge. | Every reachable site reports 10.8.5, an official patched maintenance build, or a later verified release. |
| Map each site to a fixed build | Classify versions 9.7.0 through 10.8.4 as affected unless they match an official patched maintenance build. | The storefront, product, cart, checkout, account, and admin payment screens remain available. |
| Back up and update | Choose 10.8.5 when compatible or the exact patched build for the site's supported branch. | Sandbox card, saved payment method, wallet, webhook, refund, and order-note fixtures pass. |
| Verify active versions | Update production, staging, development, multisite, and dormant public copies, then verify the loaded plugin version. | Monitoring shows no unexplained availability or payment error increase after deployment. |
Decision rule
A site remains exposed until the active plugin version exactly matches a fixed build or a later safe release and the store passes a post-update availability and payment test.
Test scenarios to run
Run the same controlled fixture across these branches. Write down the expected result before testing so a surprising response is easy to identify.
| Scenario | Fixture | Expected result |
|---|
| Latest branch | 10.8.4 or earlier in 10.8 | Update to 10.8.5 and run the payment fixture |
| Pinned branch | 10.7 through 9.7 | Use the exact patched maintenance version listed by WooCommerce |
| July patch | Store updated after the July 14 advisory | Update again because the August advisory covers a separate issue |
| Fleet | Production plus public and dormant copies | Every reachable site reports a verified fixed version |
Safe fix order
Use a sequence that makes each result easy to prove. Stop when new evidence changes the scope or owner of the problem.
- Export the version fleet
- Map each site to a fixed build
- Back up and update
- Verify active versions
- Run payment and availability tests
Production verification checklist
- Every reachable site reports 10.8.5, an official patched maintenance build, or a later verified release.
- The storefront, product, cart, checkout, account, and admin payment screens remain available.
- Sandbox card, saved payment method, wallet, webhook, refund, and order-note fixtures pass.
- Monitoring shows no unexplained availability or payment error increase after deployment.
What to tell the client or owner
Share each site URL, before and after version, branch constraint, update time, payment fixture results, webhook events, errors, and monitoring window.
Mistakes to avoid
- Do not assume the July security patch covers the August advisory.
- Do not mark a site complete from its auto-update setting.
- Do not choose a maintenance build without matching the current supported branch.
- Do not stop at version verification without testing store availability and payments.
Questions teams ask during testing
Which versions are affected?
WooCommerce lists Stripe for WooCommerce versions 9.7.0 through 10.8.4 as affected.
What is the preferred fixed version?
Use 10.8.5 when compatible. The advisory also lists patched builds for supported older branches.
Was customer or payment data accessed?
WooCommerce says it has no evidence that the issue was exploited or used to access customer or payment data.
When HandL WP should help
HandL WP can inventory a WooCommerce fleet, select the correct fixed Stripe build, deploy with rollback protection, and verify checkout and availability.
If this is active on a production site, update Stripe for WooCommerce safely.
Related HandL WP guides
Use these related guides when the same issue touches tracking, security, checkout, or crawler visibility.
Monitor the patched Stripe checkout after deployment
After version verification, run the Stripe for WooCommerce 10.8.5 monitoring and log audit to reconcile checkout, webhook, order, scheduled-action, refund, security, and conversion evidence.
Test saved payment methods after the update
Run the Stripe for WooCommerce 10.8.5 saved payment method regression test across new cards, saved cards, SCA, expired methods, subscriptions, and cross-account denial.
Helpful references