WooCommerce 11.2 update

Two releases in October 2026

WooCommerce 11.2.0 shipped on 7 October 2026. The author is Shani Banerjee. The note calls the release backward compatible, says there is a database update, and counts 642 merged changes and 93 contributors. 11.2.1 is 9 October 2026. The author is Michal Iwanow. This small release has no security update and no database update. The second package, two days later, closes checkout bugs from the first. A shop should not stay on 11.2.0. It should move to 11.2.1.

This is not WordPress core’s October patch. On the core side, 6.8.11 is 6 October. The two sit in the same week and install separately. The core update list is in the security article. Major release 7.0 is from May. Its editor note is separate.

What the shop will see

The product CSV importer, with “update existing products” on, no longer matches a row only by ID or SKU. If ID and SKU are missing, it matches GTIN, UPC, EAN, or ISBN. The line is there so a barcode catalog does not open a new product by mistake on a row without a SKU. Still test the match on a small file before the import. The live catalog is not the test.

The additional checkout fields API accepts a date field. A birthday or a delivery day can be asked for from the checkout block. That is not a calendar that appears on every theme by itself. A plugin or a theme defines the field. The API carries the field type.

Emails for an order-withdrawal request can be configured. The acknowledgement to the customer and the notice to the store are switched from WooCommerce, Settings, Emails. Recipient, extra text, and preview live there. If you used to write the withdrawal text by hand, open these two templates and put your sentence in. If you leave them off, the request can stay silent.

Block styles grew too. The new styles sit on top of styles those blocks already had. A theme overrides them from global styles or from one block. That does not mean the storefront color changes by itself in 11.2. The change arrives when the theme uses those styles.

What the security note closes

11.2.0 carries security fixes. WooCommerce wants shops on 11.2. Four headings matter to the site owner.

Cc or Bcc can no longer be set on the password reset, new account, and email confirmation messages. Those messages carry a reset or verification link. Addresses saved earlier are ignored. An integration that needs a copy adds it through the filter written for that. The same limit applies to the back-in-stock verification email. The REST settings endpoints no longer expose Cc and Bcc for these three messages.

Downloadable-product authorization is tighter. A malformed order or email is rejected before the permission lookup. A standard download link stays the same. Old, hand-built, or imported broken records can stop. The shop reissues the link, fixes the permission record, or corrects the billing email and regenerates permissions. Regenerating resets the download count and the logs. Before you do that, write down whether the counter matters to you.

A shop manager can no longer edit a user who also holds a role outside the roles that manager may edit. The example given is a bbPress or Ultimate Member role. An administrator can still edit. Adding a role is possible through a filter. On multisite, importing a Blueprint now requires a network super admin. A subsite administrator cannot import one. A single-site shop is not affected by that line.

If usage tracking is on, WooCommerce also checks that sensitive fields are left out of what it sends. A site that keeps tracking off does not run that line.

The PublishPress Future warning

PublishPress Future 3.0.0 through 4.10.3 can cause a fatal error on WooCommerce 11.2. The plugin loads its own old copy of Action Scheduler instead of the one that ships with WooCommerce. The fix is in 4.10.4. If this plugin is installed, update it before WooCommerce. If it is not installed, this paragraph creates no task for you. Another scheduling plugin may not throw the same error. Still read the version note if a plugin uses Action Scheduler.

What 11.2.1 fixed at checkout

The 9 October release closes two bugs. The first is classic checkout that removes address fields. 11.2.0 sent address data differently from 11.1 when the order summary refreshed. Shops that remove fields with woocommerce_billing_fields or woocommerce_default_address_fields could hit a wall that says to enter an address to continue, could fail to charge tax, or could lose shipping options. 11.2.1 puts the 11.1 behavior back.

The second is the postcode on the checkout block. Argentine codes without the province letter, for example 1213, are accepted again. Formats for El Salvador, Saint Vincent and the Grenadines, and the British Virgin Islands that 11.2.0 rejected also pass again. A Turkish postcode is not named in that note. A shop in Turkey does not skip 11.2.1 because of that line. The other fixes and the database update are in 11.2.0. 11.2.1 sits on top of them.

Update order and the plan

Take a backup. If PublishPress Future is present, move it to 4.10.4 or newer. Install 11.2.1 on staging. Run the database update. Place one test order on classic checkout and one on block checkout. If you sell a downloadable product, click an old link. In email settings, see that Cc on the password reset line is closed. Then move to production.

The OwnHost WordPress hosting page writes the Pro card for WooCommerce, agencies, and multiple sites. It is $3.29 a month, or $26.99 when billed yearly. It lists ten sites, staging, a daily backup, and 4096 MB of RAM. Personal is $0.79 a month, or $8.99 a year. It lists one site, 15 GB NVMe, and a weekly backup. Personal has no staging line. Because an 11.2 test wants staging, look at the Pro card. The PHP version is not on the card. If the plugin upgrade needs a PHP version, read it in the panel. The PHP calendar is in a separate article.

WooCommerce 10.8 set a WordPress 6.9 requirement. The 11.2 note, as used in this article, does not announce a new minimum WordPress version. Open the update guide before you install. If core is older than the plugin requires, core is updated first. The reverse happens too: moving core to 7.0 and leaving the plugin short of 11.2 leaves the plugin half of the October security note open. Close both in the same window.