I was halfway through my first coffee when a long-time client pinged me on Slack, badly rattled. One of his logged-in customers had sent over a screenshot of their own account dashboard, and it was showing the shipping address and email for a guest order that had nothing to do with them. My first guess was a misconfigured caching plugin, because it usually is.
An hour went into Redis and Cloudflare logs on that theory. The logs were clean. Then the security advisory came through: GHSL-2025-129, a vulnerability in the code the WooCommerce Store API security patch addresses. Versions 8.1 through 10.4.2 carried a logic flaw that let authenticated users read guest order data. On a high-volume shop that is the kind of finding you want to act on the same morning.
What the WooCommerce Store API security patch fixes
The problem sits in the WooCommerce Store API, which does most of the work behind modern checkouts and blocks-based themes. No card data was involved, which is the only good news here. Names, emails, phone numbers and full shipping addresses were. On guest checkouts the API did not properly verify that whoever asked for the order details was the person who had placed the order. Clearing a cache does nothing for that, because the bug is in how the API decides who may see an order.
As noted on developer.woocommerce.com, this reached nearly every version released in the last two years. The fix went out broadly, with Automattic shipping patches for 23 separate versions. 10.4.3 is safe. Anything from 8.1 to 10.4.2 is not. Worth knowing: the endpoint can be exposed even on sites that never adopted the Checkout Block.
/**
* A quick way to check if your current WooCommerce version
* is within the vulnerable range.
*/
function bbioon_is_vulnerable_version() {
if ( ! class_exists( 'WooCommerce' ) ) {
return false;
}
$current_version = WC()->version;
$is_vulnerable = version_compare( $current_version, '8.1', '>=' ) && version_compare( $current_version, '10.4.3', '<' );
if ( $is_vulnerable ) {
error_log( 'bbioon Security Alert: WooCommerce ' . $current_version . ' is vulnerable to GHSL-2025-129.' );
}
return $is_vulnerable;
}What to do now
Resist the urge to hit update on production and hope. I have watched too many developers take a store down that way because they skipped staging. The WooCommerce Store API security patch is urgent, but it is not urgent enough to abandon a sane deployment process. Check your version under Plugins, then WooCommerce. On something like 9.8.5, 9.8.6 is where you need to be. Because the patch is backported you do not have to leap to the newest 10.x release if breaking changes worry you, but you do have to reach the patched minor release.
- Verify your current version in the WordPress admin.
- Back up the database before you touch anything.
- Update to the patched version, whether that is 10.4.3 or the backported equivalent for your branch.
- Watch your server logs for unusual REST API requests aimed at the store endpoints.
Most of this gets fiddly in practice. If you have inherited someone else’s setup and you would rather not track advisories yourself, my team does this work. Send us a message.
Where that leaves you
Official APIs get things wrong too, so patching cannot be a once-a-quarter habit. Keep the core plugins current and put something in place that tells you the day an advisory like GHSL-2025-129 lands. Finding out from your own monitoring is a very different morning from finding out from a customer’s screenshot.
