WooCommerce 11.2.2 Adds Security Hardening for Store and REST API

WooCommerce 11.2.2 is now available for download. The WooCommerce developer blog describes it as a security release with multiple security updates, and it recommends that store owners update as soon as possible. The release also includes a database update that cleans up affected data.

The security changes cover several areas. Store API hardening adds protections for cart item quantities, REST API key authentication, and checkout tax calculation for local pickup. Store API checkout now stops if an order fails to save, and each checkout request starts with its own order and payment data. Two wc-admin connection endpoints, onboarding/plugins/jetpack-authorization-url and plugins/connect-jetpack, now require a logged-in administrator browser session with a wp_rest nonce. Requests using REST API keys, WP-CLI, or application passwords receive a 403 on those endpoints. The wc-admin client is not affected.

The release also includes smaller fixes. The product CSV importer validates column mapping more strictly, and product default attributes are handled more safely when a global attribute term is renamed. The cart now ignores attributes a product does not use, and PayPal Standard shipping address updates recalculate shipping and tax correctly.

Why it matters

Security releases matter most for stores that handle checkout and admin integrations, and this update touches both. Checkout changes prevent a partially saved order from moving on to payment. Teams that connect tools through REST API keys or WP-CLI may find that some admin requests now fail with a 403, so they should expect those integrations to need attention.

What to do

Update to WooCommerce 11.2.2 soon and run the included database update. Review the update guide and full changelog on the WooCommerce site before rolling out the change, since this summary covers only the release notes. If you rely on automated scripts that call the Jetpack connection endpoints, test them after updating.