WooCommerce published an August 5, 2026 security advisory for WooCommerce Subscriptions. The company says a serious issue could allow an unauthorized user to assume control of an affected site. It reports no evidence of exploitation or data access, but affected stores should update immediately and verify every production, staging, and development copy.
Use this for stores running WooCommerce Subscriptions, agencies managing licensed extensions, public staging sites, multisite networks, and teams with custom renewal or webhook code.
Quick answer
Take a restorable backup, verify that WooCommerce Subscriptions 9.1.0 or newer is actually active on every copy, and do not rely on an auto-update setting as proof. Then review administrator accounts, active sessions, application passwords, API keys, file changes, scheduled actions, webhooks, payment behavior, and subscription renewals. Escalate unexplained control-plane changes as an incident.
What to check first
- Inventory the active WooCommerce Subscriptions version on production, public staging, development, multisite, and dormant clones.
- If the update is missing, verify the WooCommerce account connection and active license, then refresh the Installed on this store view.
- Review administrator users, recent user changes, active sessions, application passwords, REST keys, payment keys, and webhook endpoints.
- Compare plugin and must-use plugin files against known packages and inspect recent modifications outside normal deployment windows.
- Run sandbox renewal, cancellation, payment failure, retry, email, stock, and scheduled-action fixtures after patching.
Why this usually happens
- A connected store can miss an update when its license, account connection, or update cache is stale.
- Staging and development copies are often public enough to be exposed but absent from the production patch checklist.
- Updating the vulnerable code reduces future risk but does not explain changes that happened before the patch.
Useful command or data shape
Adapt paths, IDs, and privacy handling to the site before running commands or storing data on production.
# Inventory first
wp plugin get woocommerce-subscriptions --fields=name,status,version,update,update_version
wp user list --role=administrator --fields=ID,user_login,user_email,user_registered
wp cron event list --fields=hook,next_run_gmt,recurrence | grep -Ei 'subscription|action_scheduler'
# Preserve evidence before removing an unexplained account or file.
Diagnostic table
Use this table to connect the observed behavior to evidence and a verification step.
| Action | Evidence to collect | How to verify |
|---|
| Back up and preserve evidence | Inventory the active WooCommerce Subscriptions version on production, public staging, development, multisite, and dormant clones. | WooCommerce Subscriptions 9.1.0 or newer is active on production and every reachable clone. |
| Update every site copy | If the update is missing, verify the WooCommerce account connection and active license, then refresh the Installed on this store view. | All administrators, sessions, application passwords, keys, and webhooks have approved owners. |
| Audit site-control surfaces | Review administrator users, recent user changes, active sessions, application passwords, REST keys, payment keys, and webhook endpoints. | File integrity and logs show no unexplained persistence or control change. |
| Test subscription workflows | Compare plugin and must-use plugin files against known packages and inspect recent modifications outside normal deployment windows. | Sandbox renewals, retries, cancellations, emails, stock, and scheduled actions pass after the update. |
Decision rule
Treat the case as an active security incident when an administrator, session, key, webhook, file, scheduled action, or configuration change lacks an approved owner or predates the verified patch with no business explanation.
Test scenarios to run
Run the same controlled fixture across these branches. Write down the expected result before testing so a surprising response is easy to identify.
| Scenario | Fixture | Expected result |
|---|
| Version | Production plus every public or connected clone | WooCommerce Subscriptions 9.1.0 or newer is active everywhere |
| Control plane | Admins, sessions, app passwords, API keys, webhooks | Every entry has an approved owner and creation reason |
| Integrity | Plugin package, mu-plugins, uploads, wp-config, cron | No unexplained executable file or persistence mechanism appears |
| Business flow | Sandbox renewal, retry, cancellation, email, webhook | Subscription state and payment side effects remain correct |
Safe fix order
Use a sequence that makes each result easy to prove. Stop when new evidence changes the scope or owner of the problem.
- Back up and preserve evidence
- Update every site copy
- Audit site-control surfaces
- Test subscription workflows
- Monitor and escalate anomalies
Production verification checklist
- WooCommerce Subscriptions 9.1.0 or newer is active on production and every reachable clone.
- All administrators, sessions, application passwords, keys, and webhooks have approved owners.
- File integrity and logs show no unexplained persistence or control change.
- Sandbox renewals, retries, cancellations, emails, stock, and scheduled actions pass after the update.
What to tell the client or owner
Share the site inventory, active version, update time, admin and key review, suspicious timestamps, file changes, logs, renewal fixtures, and WooCommerce support case.
Mistakes to avoid
- Do not assume auto-update means the fixed version is active.
- Do not forget public staging, development, multisite, and dormant copies.
- Do not delete suspicious evidence before recording it.
- Do not finish after patching without testing renewals and auditing site control.
Questions teams ask during testing
Which version should be installed?
WooCommerce instructs stores to update WooCommerce Subscriptions to version 9.1.0 or newer.
Was exploitation reported?
The advisory states that WooCommerce had no evidence the vulnerability had been exploited or used to access store or customer data.
What if the update is unavailable?
Check the WooCommerce account and license connection, refresh the store installation view, or contact WooCommerce support about a security-only build.
When HandL WP should help
HandL WP can verify extension coverage across site copies, patch safely, audit users and keys, inspect integrity evidence, and test subscription renewal behavior.
If this is active on a production site, secure a WooCommerce Subscriptions store.
Related HandL WP guides
Use these related guides when the same issue touches tracking, security, checkout, or crawler visibility.
Complete the Subscriptions 9.1.0 rollout
Use the Subscriptions 9.1.0 security-only installation checklist, resolve an update missing from the WooCommerce account screen, and reconcile every environment with the production and staging fleet version report.
Close the Subscriptions advisory beyond the version screen
After installing the fixed build, run the post-update admin capability diff, compare the plugin against a trusted Subscriptions file baseline, and complete the API key rotation inventory for credentials that crossed the incident boundary.
Helpful references