WooCommerce Security Updates: Subscriptions and Stripe Patched

Two WooCommerce security advisories in twenty-four hours is not a coincidence, and it is not a bad week either. It is what a working security pipeline looks like when someone is actually doing the internal review. You would rather see two of these in one day than one every six months, because the alternative is that the vulnerabilities are still in there and nobody has looked.

The one you patch first is WooCommerce Subscriptions. The one you patch same-day is Stripe for WooCommerce. Both come out of Automattic’s own internal testing, both have patched versions available right now, and both hit plugins that sit directly on the money path for the average WooCommerce store. That is the whole editorial for today: which one goes first, why, and what the pattern says about the WooCommerce Foundations effort we wrote about two weeks ago.

I have spent enough Sunday afternoons on incident calls to know the shape of this: not “everything is broken”, but “you have twenty-four hours before someone with a scanner notices, so let us just get it done tonight”. That is the frame. Now to the news.

What is actually new

On August 5, 2026, the WooCommerce Developer Blog published a security advisory for WooCommerce Subscriptions. Every version prior to 9.1.0 is affected. The advisory names multiple issues found through Automattic’s internal security review, and it is unusually blunt about the worst one: “an unauthorized user could assume site control.” That is the phrase you read twice. It is not customer-data exposure and it is not a checkout bypass; it is a path to admin. The fix is a single update to 9.1.0 or later. There is no evidence of active exploitation, and the advisory recommends the standard post-incident hygiene for anyone worried: audit logs and files, review admin accounts, remove suspicious files, reset passwords, rotate API keys.

Less than twenty-four hours later, on August 6, 2026, Brian Coords posted a second WooCommerce security update for the Stripe for WooCommerce plugin. The affected range is 9.7.0 through 10.8.4. The patched line is 10.8.5, plus backported fixes for older major versions (10.7.2, 10.6.3, 10.5.4, 10.4.1, 10.3.2, 10.2.1, 10.1.1, 10.0.2, 9.9.3, 9.8.2, 9.7.2) so nobody on an older release line has an excuse to stall. The severity here is different from Subscriptions: the worst case is that “an affected store could become unavailable” under specific conditions. No customer or payment data exposure. Availability, not confidentiality. Also caught by internal testing, also no evidence of exploitation.

Both advisories share a template that is worth noticing on its own: internal review, coordinated backport across supported minor lines, no CVE numbers in the public post because the technical detail is being withheld while the fleet updates. This is the same tone the project used for the WooCommerce 11.0 delay note and the same tone Matt used in Defensive Data Design a few days ago. There is a doctrine forming here, and this week you are seeing it applied in real time.

Why it matters for WordPress and WooCommerce people

Every WooCommerce agency I know runs a stack where at least one of these two plugins is on every managed store. Subscriptions is the plugin that turns a WooCommerce install into recurring revenue; Stripe for WooCommerce is one of the two payment gateways I see on every consumer store built after 2022. If both are on the same site, you have two patches to ship this week and the sequence matters.

Subscriptions is first, and it is not close. “Assume site control” is the ceiling of impact. If your client roster includes any Subscriptions installs still pinned to an older version (the ones you inherited from a previous agency, the ones on a hosting plan where auto-updates were turned off “for stability”), those are tonight’s work. Stripe is next-day work. “Unavailability” is bad, and on a Black Friday it would be catastrophic, but on a regular Thursday it is a service interruption, not a breach.

The broader signal is more interesting than either advisory in isolation. Automattic committed publicly, in the July 13 pre-release notes for WooCommerce 11.0 and the Foundations initiative that framed the whole quarter, to spend more of their engineering budget on core reliability, performance, and yes, security review. Two disclosures in one week, both from internal testing, both with coordinated backports across supported lines, is what that commitment looks like when it stops being a blog post and starts being a workflow. You do not get to see this kind of discipline on a hosted commerce platform; you get “we deployed a fix” and no forensic trail.

What I would do (or not do) about it

Tonight, in order:

1. Run wp plugin list --format=json across every managed store, filter for woocommerce-subscriptions, and list every install below 9.1.0. That list is tonight’s queue.
2. Stage the update on a clone first for anything running WooCommerce Subscriptions alongside a custom checkout, a subscription-linked membership plugin, or a Zapier/webhook integration that hits the subscription lifecycle. The advisory is a single-file patch on the surface, but a major-version bump on the largest recurring-revenue plugin in the ecosystem deserves the fifteen minutes of caution.
3. Ship the update. On sites where you already trust the auto-update path, let it run; on sites where you do not, do the click yourself and verify the version on the Plugins screen before you close the tab.
4. Same pass, second column: any store on Stripe for WooCommerce between 9.7.0 and 10.8.4 gets the corresponding patched version. Tomorrow morning is fine for this one; do not stack it on the Subscriptions window if you can avoid it.
5. For clients on any older major line of Stripe for WooCommerce, the backport list is your friend. Do not force a major jump today just because the changelog looks tidy; use the matching patched build for the line you are on and schedule the major upgrade for its own change window later this month.

Three things I would not do. First, do not write clients a panicked email that reads “critical vulnerability, act now”. Write the calm version: “Automattic disclosed two issues this week, we have patched every store on our roster, here is the summary.” That is what a governance layer sounds like when it is working. Second, do not skip the ten-minute smoke test on checkout after the Stripe update: card, saved card, 3-D Secure prompt, one refund. It is the shortest test in the world and it catches every regression that has bitten me in the last five years. Third, do not install any “WooCommerce security dashboard” plugin whose entire pitch is “we notify you when Automattic notifies you”. You already get notified — the developer blog RSS feed and your update notifications are the source of truth, and adding a third-party layer between you and a security advisory is exactly the wrong direction of trust.

Two advisories in twenty-four hours is not the story to lose sleep over. The story is that the pipeline that produces them is the same pipeline that will produce the ones you never hear about, quietly, for the next ten years. That is the value proposition, and it is the reason we still build enterprise stores on this stack.