A client running a high-volume shop called me last week in a panic. Their server logs were ballooning and their third-party ERP was getting hammered with duplicate webhooks. Once I went through the traces, it turned out they were stuck in an infinite “sync-on-read” loop, a side effect of the way High-Performance Order Storage (HPOS) handles modified dates. That is the sort of thing the WooCommerce security update in version 10.4.3 is there to stop.
My first instinct was to throttle the webhooks at the server level, and I have watched plenty of other devs try the same thing. It was the wrong fix. The server stopped crashing, but legitimate order notifications and shipping updates died along with the noise. The actual cause was HPOS sync re-enqueuing events because the posts table and the HPOS tables could not agree on when the order was last touched. Version 10.4.3 puts a leash on that by disabling sync-on-read during heavy processes such as Analytics imports.
Why you should not sit on the WooCommerce 10.4.3 security update
The main item in this release is the security patch for the Store API. On any version from 8.1 through 10.4.2, an authenticated user could read guest order data. Under GDPR and PCI rules that is a real exposure, not a theoretical one. It is the same argument I made in our WooCommerce Store API security patch checklist: take the dot releases seriously before a leak forces you to.
The other change worth knowing about is the Bulgaria currency transition. For stores operating in the EU, WooCommerce now handles the BGN to EUR switch automatically on January 1, 2026, based on server time. Nobody has to sit up at midnight on New Year’s Eve changing settings by hand. Small piece of automation, and a welcome sign that the core team is planning ahead.
/**
* A quick way to check if HPOS sync is currently restricted
* during sensitive operations in WooCommerce 10.4.3+.
*/
function bbioon_check_hpos_sync_status() {
if ( class_exists( 'ToolsUtil' ) && method_exists( 'ToolsUtil', 'is_sync_on_read_enabled' ) ) {
$sync_enabled = \Automattic\WooCommerce\Internal\DataStores\Orders\ToolsUtil::is_sync_on_read_enabled();
return $sync_enabled ? 'Syncing active' : 'Syncing throttled';
}
return 'Legacy storage active';
}The “Undo” link works again
Version 10.4.2 broke the “Undo” link in the cart shortcode. If a customer removed an item by accident, the restoration data was cleared before they could click the link. That sounds minor until you put it in front of real checkout traffic, where it costs you orders. 10.4.3 reverts the regression. As I wrote in my post on proactive plugin updates, small regressions like this one are why we test on staging first.
The full technical breakdown of these fixes is on the official WooCommerce Developer blog, but the short version is to update. Between the guest data exposure and the HPOS sync loops, staying on 10.4.2 is how you end up with a paging alert at midnight.
What to do now
If you manage a shop, move it to 10.4.3. Test your checkout flow and any custom API integrations you have built, since the Store API changes can affect how you fetch guest data. And check your server logs for those sync loops if you migrated to HPOS recently.
This stuff gets complicated quickly. If you are tired of debugging someone else’s mess and just want the site to work, drop my team a line. We have dealt with these loops and leaks plenty of times.
