WooCommerce sent out a barrage of emails to users today with the first one arriving in a client’s inbox around 6:30pm Central USA time warning of a critical vulnerability found in their plugin between versions v3.3 to v5.5. That is a very wide range of versions and it is likely that any website using WooCommerce is vulnerable to the exploit discovered.

WooCommerce and Automattic (the parent company of WordPress and WooCommerce) did not reveal details behind the vulnerability only to say that it was “Critical”. Typically a designation of “Critical” would mean that a hacker could gain access to customer records, payment info (if stored), order records, gain the ability to plant malware on an install, or take over a website completely.

It is strongly advised that anyone running WooCommerce updates to the latest version, which as of writing is v5.5.1 in order to patch this exploit.

The vulnerability (or possibly a different one) was found in the WooCommerce Blocks plugin between versions v2.5 and v5.5 and as well that plugin has been updated to v5.5.1 for a fix to this issue.

Before updating ALWAYS run a backup of your website and download it or push the backup to a cloud storage host.

Here is the full text of the WooCommerce email today:

Hi there,

We’re reaching out to let you know that a critical vulnerability was identified in WooCommerce (versions 3.3 to 5.5) and the WooCommerce Blocks feature plugin (versions 2.5 to 5.5).

What actions should I take with my store?

Stores hosted on WordPress.com and WordPress VIP have already been secured. We are working with the WordPress.org Plugin Team to automatically update as many stores as possible to secure versions of WooCommerce. We also urge you, however, to take the following added precautions to safeguard your site:

Update your copy of WooCommerce to the latest version (5.5.1) or the highest number possible in your release branch.

If you are running the WooCommerce Blocks feature plugin, you’ll need to update it to the latest version (5.5.1).

What does this mean for my store?

Our investigation into this vulnerability is ongoing, but we wanted to let you know now about the importance of updating immediately.

We will be sharing more information with site owners on how to investigate this security vulnerability on their site, which we will publish on our blog when it is ready. If a store was affected, the exposed information will be specific to what that site is storing but could include order, customer, and administrative information.

What can I expect from WooCommerce in the future?

Our intention is always to respond immediately and operate with complete transparency. Since we discovered this vulnerability yesterday, the WooCommerce team has worked around the clock to investigate the issue, audit all related codebases, and release a patch for every impacted version (90+ releases).

If you have any other questions, we’re here to help – reply to this email.

Thanks for reading,

The Woo Team