A security update is available for WooCommerce Subscriptions. If you use the extension, update to version 9.1.0 or later immediately.
The update addresses several security vulnerabilities, the most serious of which an unauthorized user could assume site control.
What you can do
Update every site running WooCommerce Subscriptions
To update:
- Go to Dashboard → Updates in WP Admin.
- Update WooCommerce Subscriptions.
- Confirm that the installed version is 9.1.0 or later.
You can also check the installed version under Plugins → Installed Plugins. Even if automatic updates are enabled or your site is hosted by Automattic, confirm that it is running 9.1.0 or later.
If you manage sites for clients, please verify the update on every production and staging site using WooCommerce Subscriptions.
Prioritize production sites, however, make sure there are no inactive staging or development copies publicly accessible and unpatched as well.
If the update is not available in WP Admin, confirm that the site’s WooCommerce.com account is connected and that its WooCommerce Subscriptions license is active. You can also download the latest release from your WooCommerce.com account. If you still can’t update to 9.1.0, contact Woo Happiness using the support link below or in your WooCommerce dashboard. They can provide a security-only patched build and help you find the safest update path.
Please note: In some cases, the plugin update may not be visible due to caching. You can clear the cache by going to WooCommerce > Extensions > My Subscriptions > Installed on this store and clicking Refresh. You should then see the Update link for WooCommerce Subscriptions.
Additional info
The vulnerabilities were identified through an internal security review. Fixes are included in WooCommerce Subscriptions 9.1.0.
We have no evidence that any store was compromised or that any customer data was accessed.
Need help?
If you have trouble updating WooCommerce Subscriptions, contact Woo Happiness using the support link in your WooCommerce dashboard.
We will update this post if there is any new information.
Leave a Reply