# WooCommerce releases security update for WooPayments subscriptions feature

WooCommerce published a security update for WooPayments on 3 November 2026, fixing an issue in the subscriptions functionality bundled with the plugin. Stores running an affected version should update and confirm the installed version.

- Page: https://www.cognivise.co.uk/news/woopayments-security-update-fixed-versions-check
- Topic: Running software
- Published: 2026-11-09
- Updated: 2026-11-09
- Author: Cognivise
- Source: WooCommerce Developer Blog, Security update for WooPayments (https://developer.woocommerce.com/2026/11/03/security-update-for-woopayments/)

## Key takeaways

- WooCommerce released fixed WooPayments versions on 3 November 2026 for a security issue in its bundled subscriptions functionality.
- Check the installed WooPayments version on every store, including public staging and development sites, even if automatic updates are on.
- Stores on any version older than 9.0.0 should update to 11.2.1, according to WooCommerce’s table of fixed versions.

## What WooCommerce announced

On 3 November 2026, WooCommerce published a security advisory for WooPayments on the [WooCommerce Developer Blog](https://developer.woocommerce.com/2026/11/03/security-update-for-woopayments/). The update fixes a security issue in the subscriptions functionality that comes bundled with WooPayments. WooCommerce says it extends a fix it announced in August.

The advisory does not describe the issue, give it a severity rating or say whether it has been exploited. It does list a fixed release for each version line. For example, a store on 11.2.0 should move to 11.2.1, a store on 11.0.0 or 11.0.1 to 11.0.2, and a store on 9.2.0 or 9.2.1 to 9.2.2. Any store on a version older than 9.0.0 should update to 11.2.1.

## Which stores need to act

Any store running WooPayments on a version that is not already a fixed release is affected. Stores already on a fixed version do not need to repeat the update.

WooCommerce is clear that automatic updates are not proof of safety. You should check the installed version even if auto-updates are switched on or your host manages updates for you.

The advisory also covers sites that are easy to forget: staging and development copies of a store that can be reached publicly. Agencies and developers managing several stores are asked to check each one, because a finished update on one site says nothing about another.

If your store does not use WooPayments, this advisory does not apply to you.

## What to check now

The advisory sets no deadline, but as this is a security fix, the sensible course is to check as soon as you can.

- In WP Admin, open Plugins → Installed Plugins, find WooPayments and note its version.
- Compare it with the fixed version for that release line in WooCommerce’s table.
- If it needs updating, select Update now, then check the version again once it finishes.
- Do the same for every live, staging and development site that is publicly accessible.
- If a developer, agency or host runs your store, ask them to confirm the installed version, and keep a record of what was checked.

If the update is not offered or fails to complete, WooCommerce asks you to contact its support team with your installed version and any error shown. If nobody is clearly responsible for keeping your store’s plugins up to date, Cognivise’s [ongoing support and ownership](https://www.cognivise.co.uk/services/ongoing-support-and-ownership) service covers that kind of routine maintenance.

## Related

- [Ongoing support and ownership](https://www.cognivise.co.uk/services/ongoing-support-and-ownership)
- [Software maintenance contracts: what a fair one includes](https://www.cognivise.co.uk/blog/software-maintenance-contract-guide)