Automattic has shipped a security patch for a WooCommerce Store API vulnerability, and if you are running anything between 5.4 and 10.5.2, your store is in scope. This is a critical Cross-Site Request Forgery (CSRF) flaw that allows arbitrary admin account creation, and it works through the way the Store API handles batch requests.
What CVE-2026-3589 actually is
I have seen plenty of security patches in 14 years of development, but patching 52 versions at once is not a normal Tuesday. The core of this WooCommerce Store API vulnerability is improper validation during batch processing. A CSRF attack works by tricking a logged-in administrator into clicking a malicious link, at which point the browser sends a request that looks legitimate because the session cookies ride along with it.
Normally a WordPress nonce (wp_rest) stops that, but the batch endpoint had a logic gap. With a non-Chrome browser, or an older Chrome running specific flags, an attacker could trigger administrative functions, including creating a new admin user, without the site owner noticing. There is no evidence of active exploitation yet, but the data exposure risk is real: order metadata and customer PII such as names, addresses and phone numbers.
How to check your site status
With terminal access, WP-CLI is the quickest way to find out where you stand. Dashboard notices are not reliable on a site under heavy load or with a stuck wp-cron, so ask the plugin directly:
wp plugin get woocommerce --field=versionIf the output is 10.5.3 or one of the patched sub-versions such as 9.9.7 or 8.8.7, you are fine. If not, this update happens today rather than next sprint. If you manage dozens of stores, a short bash loop over the fleet will tell you which ones need attention.
Patching it safely
Updating WooCommerce is rarely one click, especially on high-volume stores where a WooCommerce Store API vulnerability fix can collide with custom hooks or legacy code. Given that the payoff for an attacker here is an admin account, this one ships now.
I had a client once who sat on a similar patch because they were worried about their checkout JS breaking. Three days later they had four new “Administrators” and a database full of spam. If stability is the concern, run a version check with a small snippet first, so you at least know whether you are in range:
<?php
/**
* Quick audit for the Store API flaw.
*/
function bbioon_check_woo_vulnerability() {
if ( ! class_exists( 'WooCommerce' ) ) return;
$version = WC()->version;
if ( version_compare( $version, '5.4.0', '>=' ) && version_compare( $version, '10.5.2', '<=' ) ) {
error_log( 'CRITICAL: Vulnerable WooCommerce version detected: ' . $version );
}
}
add_action( 'admin_init', 'bbioon_check_woo_vulnerability' );I wrote up the update itself in more detail in my guide to updating to 10.5.3, and there is also the security patch checklist I put together earlier this year.
If this WooCommerce Store API vulnerability is eating your dev hours, I can take it off your plate. I have been working with WordPress since the 4.x days.
What to do this week
The official WooCommerce Developer Blog confirmed that many sites were auto-patched, which is not the same as yours being patched. Check your version, read through your user list for admins you do not recognize, and go over the CSRF protection logic in any custom API integration you own. If you run WPScan, sync its database so CVE-2026-3589 shows up in your next scan.
