Maybe it slipped past you while you were tucking into the mince pies, or you simply skimmed over it in the pre-Christmas rush, but on 22 December 2025 a very important email may have landed in your inbox from the WooCommerce team.
The subject line looked harmless: “Security vulnerability identified in WooCommerce has been patched”.
The content was less reassuring, though: they had patched a security hole that had been open for two years in the world’s most popular e-commerce platform, and which allowed unauthorised people to see other customers’ orders.
If you are running a version between 8.1 and 10.4.2 (so you are almost certainly affected) and haven’t yet updated to 10.4.3, stop reading now and start the update. Now.
When you’re done, come back and we’ll explain exactly what happened, and why you can’t sit back and relax in the future either.
What exactly happened? (The technical background)
The flaw was hidden in WooCommerce’s Store API. This is the interface through which various modern features of your shop (e.g. the block-based checkout) communicate with the database.
The type of vulnerability is what the industry calls IDOR (Insecure Direct Object Reference).
Think of it like a hotel reception desk.
You check in to the hotel (you are a registered user of the shop).
You go to reception and ask for your bill.
The receptionist (the API) doesn’t ask for your room key, just: “Which room number?”
You say a random number (the ID of a guest order).
And without a second thought, the receptionist hands you the bill of someone who has already checked out (a guest customer), complete with their name, address and everything they bought.
The flaw was caused by the system checking that you were logged in, but not checking strictly enough whether the order you were requesting was actually yours – provided it was a guest (unregistered) order.
Technical details: why “only” guest orders?
(This part is for developers)
WooCommerce ties registered users’ orders more strictly to their user_id. Guest orders, however, are technically “ownerless” in the database (they often run with an ID of 0 or with session-based identification).
One of the Store API endpoints allowed an authenticated user (i.e. any registered user, even one with the “Customer” role) to retrieve this data if they knew or guessed the order ID. Although WooCommerce said this required “specific knowledge”, order IDs are often sequential (1001, 1002, 1003…), so they could be worked through with a simple script.
“It existed for two years but wasn’t exploited” – so what’s the problem?
WooCommerce’s email stresses: “At this time, we have no indication that this vulnerability has been exploited.”
That sounds reassuring, but in 2025 cyber security has one harsh rule: as soon as the fix (patch) is released, the vulnerability becomes public.
Hackers aren’t resting now. They are doing what we call “reverse engineering”: they look at the difference between the code of WooCommerce 10.4.2 and 10.4.3.
They see which file the check was changed in.
From that, they work out within 5 minutes how the site could have been attacked.
And they write a bot that, from now on, scans the internet for online shops that haven’t updated yet because of the Christmas break.
So the danger is greatest now, not over the past two years.
What data could have been at risk?
Although no card details leaked (WooCommerce doesn’t store them directly in a readable form), under UK GDPR this could still have been a serious incident. The accessible data:
The customer’s full name
Delivery and billing address
Email address
Phone number
List of products purchased
This dataset is perfect raw material for future phishing attacks.
What do you need to do as an online shop owner?
Update immediately: Check the version number under Dashboard -> WooCommerce -> Status. If it isn’t 10.4.3 (or newer), update straight away.
Clear your caches: If you use a caching plugin (WP Rocket, LiteSpeed Cache) or server-side caching, be sure to clear it after the update. Old, vulnerable API responses may still be sitting in the cache.
WPShield check: If you’re a client of ours, you can relax. Our systems monitor versions, and as part of our managed maintenance we handle critical updates like this as a priority.
The lesson for 2025
This case perfectly illustrates why there is no such thing as a “finished” online shop. Software changes constantly, and flaws sometimes stay hidden for years. The WooCommerce team responded with exemplary speed and fixed the flaw in every supported version (all the way back to 8.1!).
Your responsibility is “only” not to leave the door open, even while you’re enjoying your holiday break. Or to leave it to people who keep watch for you over the holidays too.
Store API vulnerability (IDOR) – guest order details could be retrieved
Registered users could see other people’s guest orders: name, address, email, phone number, products. No card details leaked. The flaw went unnoticed for two years.
Affected: WooCommerce 8.1 – 10.4.2
Fixed version: 10.4.3
Patch: 22 December 2025
No sign of exploitation
Update immediately
Dashboard → WooCommerce → Status: it should be 10.4.3 or newer.
Clear your caches
Clear WP Rocket, LiteSpeed Cache and any server-side cache.
Get a security check
Ask for a review if you’re not sure you’re protected.
Why is it most dangerous now? – timeline
- ~2023 – the flaw is introduced into the Store API and goes unnoticed for two years.
- 22 Dec 2025 – security fix (10.4.3) + email from WooCommerce.
- A few hours later – the patch makes the hole public, and bots start scanning.
- NOW – the danger is at its peak: anyone who hasn’t updated has left the door open.
Frequently asked questions
Do I need to notify my customers (UK GDPR)?
According to WooCommerce’s official position, there is no evidence that anyone has exploited the flaw, and the fix was preventive, so at the moment it is not necessary to cause panic by notifying your customers. Reporting to the ICO is only required if a personal data breach has likely occurred.
Would WPShield have protected me even without the update?
This was a so-called logic flaw in the application code, which is hard to filter out with a traditional web application firewall (WAF), because the request looks technically “legitimate” (a logged-in user requesting some data). That’s why patch management – fast updating – is critical, and it’s part of our service.
My WooCommerce is set to update automatically. Am I safe?
In principle, yes. WooCommerce can also push forced security updates in cases like this. But don’t take it for granted: log in and check manually. A hosting glitch or a conflict with another plugin can often stop the automatic process.
Tired of that sinking feeling every time a security email arrives?
Leave your online shop’s protection to the WPShield team, and we’ll make sure the fixes are already in place by the time you read the news.
