WooCommerce, WordPress and PHP stack breach guide
Published 4 Nov 2026 · Updated 2026-11-04
If you sell online with WooCommerce, three layers need patching: PHP (8.2.35, 8.3.36, 8.4.27, 8.5.12 or later), WordPress (7.1.4 or later) and every WooCommerce extension, especially WooCommerce Subscriptions (9.1.0 or later) and WooCommerce Payments. A store breach exposes customer names, addresses and order history, and attackers often inject card-skimming code into checkout.
Who this is for: Australian online stores selling through WooCommerce on WordPress. Written by our collective of Melbourne web and app developers; facts checked against NVD, the CISA KEV catalog and vendor advisories on 2026-11-04. Free to use and share.
Book a free stack check Already breached? First steps
Supported versions
WooCommerce (and official extensions)
WooCommerce runs on WordPress and PHP, so the WordPress and PHP support rules apply. Extensions such as WooCommerce Payments and WooCommerce Subscriptions are versioned separately: update each one from the Plugins screen.
Source: WooCommerce (and official extensions) official lifecycle (checked 2026-11-04).
WordPress
WordPress does not publish fixed end-of-life dates per branch. The project recommends running the latest release (7.1.4 at the time of writing, released 28 October 2026); security fixes are sometimes backported to older branches, but only the current release is fully supported.
| Branch | Active support | Security support until |
|---|---|---|
| 7.1 | Current release (7.1.4) | Supported |
| 7.0 and older | — | Backports only, at the project's discretion |
Source: WordPress official lifecycle (checked 2026-11-04).
PHP
| Branch | Active support | Security support until |
|---|---|---|
| 8.1 and older | — | End of life |
| 8.2 | 2024-12-31 | 2026-12-31 |
| 8.3 | 2025-12-31 | 2027-12-31 |
| 8.4 | 2026-12-31 | 2028-12-31 |
| 8.5 | 2027-12-31 | 2029-12-31 |
Source: PHP official lifecycle (checked 2026-11-04).
Key high and critical CVEs for this stack
These are recent high or critical vulnerabilities. "KEV" means CISA lists it as known to be exploited in the wild.
| CVE | Component | Affected | Fixed in | CVSS | KEV |
|---|---|---|---|---|---|
| CVE-2026-18391 | WooCommerce (and official extensions): WooCommerce Subscriptions: PHP object injection (unserialize) on stores with High-Performance Order Storage, escalating to remote code execution | WooCommerce Subscriptions before 9.1.0 | 9.1.0 | 9.8 (CVSS 3.1, WPScan) | Not listed |
| CVE-2023-28121 | WooCommerce (and official extensions): WooCommerce Payments: unauthenticated requests on behalf of an administrator (authentication bypass) | WooCommerce Payments 4.8.0 to 5.6.1 (fixed builds per branch, e.g. 4.8.2, 5.6.2) | 5.6.2 (or the patched build on your branch) | 9.8 (CVSS 3.1, NVD) | Not listed |
| CVE-2026-119977 | WordPress: Upgrade-window race condition (predictable staging paths) allowing unauthenticated code execution | 4.7 through 7.1.3 | 7.1.4 | 8.1 (CVSS 3.1, Wordfence) | Yes (added 2026-11-03) |
| CVE-2026-87902 | WordPress: Page-template resolution local .php file inclusion, can lead to remote code execution | All branches before 4.7.37 … 6.9.9, 7.0.6, 7.1.2 (see NVD for each branch) | 7.1.2 (and branch backports such as 6.9.9, 6.8.10) | 8.1 (CVSS 3.1, CNA) | Yes (added 2026-09-25) |
| CVE-2026-63030 | WordPress: REST API batch endpoint route confusion; chained with CVE-2026-60137 (WP_Query author__not_in SQL injection, CVSS 5.9) for remote code execution | 6.9.x before 6.9.5, 7.0.x before 7.0.2 | 6.9.5, 7.0.2 | 9.8 (CVSS 3.1, WPScan) | Yes (added 2026-07-21) |
| CVE-2026-109618 | PHP: Out-of-memory handling memory corruption leading to unauthenticated remote code execution | 5.x/7.3 up to 8.2.34, 8.3.0–8.3.35, 8.4.0–8.4.26, 8.5.0–8.5.11 (7.3.0+ per NVD) | 8.2.35, 8.3.36, 8.4.27, 8.5.12 | 9.2 (CVSS 4.0, PHP) | Yes (added 2026-10-26) |
| CVE-2026-109619 | PHP: Stale internal request state leading to unauthenticated remote code execution | 5.4.0 up to 8.2.34, 8.3.0–8.3.35, 8.4.0–8.4.26, 8.5.0–8.5.11 | 8.2.35, 8.3.36, 8.4.27, 8.5.12 | 9.2 (CVSS 4.0, PHP) | Yes (added 2026-10-26) |
| CVE-2024-4577 | PHP: PHP-CGI argument injection on Windows (Apache + PHP-CGI, certain code pages) | 8.1 before 8.1.29, 8.2 before 8.2.20, 8.3 before 8.3.8 | 8.1.29, 8.2.20, 8.3.8 | 9.8 (CVSS 3.1, PHP) | Yes (added 2024-06-12) |
How attacks on this stack typically work
- Attackers exploit an unpatched core, PHP or extension flaw to gain admin or code execution, then add JavaScript to the checkout page that copies card details as customers type (often called web skimming or Magecart-style attacks).
- Admin takeover flaws like CVE-2023-28121 in WooCommerce Payments let an unauthenticated attacker act as an administrator and create new admin accounts.
- PHP object injection in extensions (CVE-2026-18391) can be chained to run code on the server and download the orders database.
- Fraudulent orders, coupon abuse and refund manipulation follow once an admin account is controlled.
Patch and hardening steps
- Find your exact versions. In WordPress, Tools → Site Health → Info shows WordPress and PHP versions; Plugins lists each plugin version.
- Back up first (files and database), and keep the backup off the server.
- Update WooCommerce (and official extensions) to at least: 9.1.0; 5.6.2 (or the patched build on your branch). Move off any end-of-life branch.
- Update WordPress to at least: 7.1.4; 7.1.2 (and branch backports such as 6.9.9, 6.8.10); 6.9.5, 7.0.2. Move off any end-of-life branch.
- Update PHP to at least: 8.2.35, 8.3.36, 8.4.27, 8.5.12; 8.1.29, 8.2.20, 8.3.8. Move off any end-of-life branch.
- Remove unused plugins, apps, themes and accounts, and turn on automatic updates for minor and security releases where available.
- Lock down admin: unique passwords, multi-factor authentication for every admin, and restrict wp-admin and XML-RPC where possible (WordPress hardening guide).
- Check for signs of compromise after patching a KEV-listed flaw: unknown admin users, unexpected new files on the server, changed checkout or header scripts.
- Follow a patching cadence. The ACSC's Essential Eight treats patching applications as a core mitigation.
What this means for your industry
Online stores hold customer names, addresses, phone numbers and order history, which is personal information under the Privacy Act. If a breach is likely to cause serious harm, you may need to notify customers and the OAIC: see what to do after a data breach.
Melbourne or Victorian public-sector supplier? See Melbourne and Victorian breach contacts. We will cover reported incidents involving these technologies in our Australian breach news.
Want a second pair of eyes on your stack?
Book a short call and one of our developers will talk through your versions and patch plan. No pressure, no scare tactics.
Frequently asked questions
Is WooCommerce itself the risk, or the extensions?
Both matter, but the most severe recent CVEs we list are in official extensions (WooCommerce Subscriptions before 9.1.0, WooCommerce Payments 4.8.0–5.6.1) plus WordPress core and PHP underneath. Update all three layers. Source
Do I have to tell customers if my store is breached?
If the Privacy Act covers your business and the breach is likely to result in serious harm, you generally must notify affected individuals and the OAIC. Many small businesses under $3 million turnover are exempt, but there are exceptions. Source
Does using Stripe or PayPal mean card data is safe?
Hosted payment fields reduce what your server stores, but if an attacker controls your site they can change the checkout page itself. Patching and monitoring for unexpected script changes still matter. Source
How do I check which extension versions I run?
In WordPress admin go to Plugins → Installed Plugins; each plugin shows its version. Tools → Site Health → Info lists WordPress and PHP versions. Source
Related stack guides
- Drupal and PHP stack breach guide
- Adobe Commerce (Magento) and PHP stack breach guide
- Next.js, React and Node.js stack breach guide
- PHP + WordPress stack breach guide
- Shopify store security guide
- Silverstripe CMS, PHP and jQuery stack breach guide
- Webflow and hosted CMS security guide
- WordPress, PHP and Node.js stack breach guide
- All stack security guides
Sources
- developer.woocommerce.com/
- nvd.nist.gov/vuln/detail/CVE-2026-18391
- nvd.nist.gov/vuln/detail/CVE-2023-28121
- developer.woocommerce.com/2023/03/23/critical-vulnerability-detected-in-woocommerce-payments-what-you-need-to-know/
- api.wordpress.org/core/version-check/1.7/
- nvd.nist.gov/vuln/detail/CVE-2026-119977
- www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-119977
- wordpress.org/news/2026/10/wordpress-7-1-4
- nvd.nist.gov/vuln/detail/CVE-2026-87902
- www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-87902
- github.com/WordPress/wordpress-develop/security/advisories/GHSA-7hp8-65ch-5whp
- nvd.nist.gov/vuln/detail/CVE-2026-63030
- www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-63030
- nvd.nist.gov/vuln/detail/CVE-2026-60137
- wordpress.org/news/2026/07/wordpress-7-0-2-release/
- www.php.net/supported-versions.php
- nvd.nist.gov/vuln/detail/CVE-2026-109618
- www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-109618
- github.com/php/php-src/security/advisories/GHSA-w8hw-w9fx-j79w
- www.cisa.gov/news-events/alerts/2026/10/21/critical-vulnerabilities-php-require-immediate-patching
- nvd.nist.gov/vuln/detail/CVE-2026-109619
- www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-109619
- github.com/php/php-src/security/advisories/GHSA-6wmf-4rv5-p3rp
- nvd.nist.gov/vuln/detail/CVE-2024-4577
- www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-4577
- www.php.net/ChangeLog-8.php
- www.oaic.gov.au/privacy/notifiable-data-breaches/about-the-notifiable-data-breaches-scheme
- developer.wordpress.org/advanced-administration/security/hardening/
- www.cyber.gov.au/business-government/asds-cyber-security-frameworks/essential-eight
General information only, not legal or professional advice. Versions and CVEs change quickly; always confirm against the vendor before acting.