WooCommerce 11.2.0: Release notes

Row matching and cleanup improvements for Product CSV importer

Product CSV importer matches by global unique id’s. With “Update existing products” enabled, the importer now matches rows by GTIN, UPC, EAN, or ISBN when no ID or SKU is present. 

Date fields in Additional Checkout API

The additional checkout fields API now supports date fields, allowing extensions and developers to collect information such as birthdays and preferred delivery dates through the Checkout block.

Configurable emails

WooCommerce now includes configurable emails for order withdrawal requests, acknowledging customers and notifying merchants when a request is submitted. Store owners can manage both emails from WooCommerce > Settings > Emails, including recipients, additional content, previews, and whether each notification is enabled.

Block styling updates

Several blocks have been updated to include more styling options. These styles are added on top of the styles that were already supported by those blocks. They can be used by themes to customize the look and feel of a store and they can be overridden by users via global styles (Appearance > Editor > Styles > Blocks) or directly in each block instance.

Security updates

WooCommerce 11.2 includes security fixes. Update all stores to 11.2.

Cc/Bcc (woocommerce/woocommerce#69537): Cc and Bcc recipients can no longer be set for the Reset password, New account, and Confirm email address emails, since these emails contain a password reset or verification link. Addresses previously saved for these emails are ignored. Developers who need a copy for an integration can still add one through the woocommerce_email_cc_recipient_{email_id} and woocommerce_email_bcc_recipient_{email_id} filters. The cc and bcc settings for these three emails are no longer exposed by the REST settings endpoints. (The Back in Stock verification email got the same change.)

Downloads (#69531): Strengthened downloadable-product authorization by rejecting malformed order and email credentials before permission lookup. Standard download links are unchanged. Rare custom or imported links, or permission records with malformed order or email data, may stop working. A store can reissue the link, fix the permission record, or correct the order’s billing email and regenerate permissions (regenerating resets download counts and logs).

Shop managers (#69533): Harden security around shop managers being able to edit other users who have additional more privileged roles. (In practice, shop managers can no longer edit users who also have a role outside woocommerce_shop_manager_editable_roles, for example, bbPress or Ultimate Member roles. Admins still can, and sites can add the role through that filter.)

Blueprints (#69529): On multisite, importing Blueprints now requires network super admin rights; subsite administrators can no longer import them. Single-site stores are unaffected.

Usage tracking (#69536): When a site opts in to usage tracking, WooCommerce now checks that sensitive information is left out of the data it sends.

Additional advisories

PublishPress Future 3.0.0–4.10.3: these versions can cause a fatal error on sites running WooCommerce 11.2, because they load their own outdated copy of Action Scheduler instead of the one bundled with WooCommerce. PublishPress fixed this in 4.10.4. If you use PublishPress Future, update it to 4.10.4 or later before updating WooCommerce.

Back in Stock Notifications are still experimental. Thanks to everyone who tested it and shared feedback. We’re working on improvements for WooCommerce 11.3.

Developer updates

For more information about this release, including Developer Advisories, API changes, and database updates, read the WooCommerce 11.2 pre-release highlights.

Code Contributors

WooCommerce 11.2 includes PRs from 93 contributors:

Abdalsalaam, abhiishek-sharma, adimoldovan, adrianlbs, AhmarZaidi, aimahdi, alefesouza, Aljullu, allilevine, anandrajaram21, annchichi, anomiex, Anuj-Rathore24, asahasrabuddhe, asllanmaciel, bacoords, barryhughes, benitoalba, brentmackinnon, chihsuan, costasovo, darkdi, dd32, dilirity, dinhtungdu, dmallory42, drewmt, drwpcom, elazzabi, faisalahammad, fiechtor, frosso, gigitux, hannahtinkler, htdat, ikamal7, ismaeldcom, j111q, JanaMW27, johndcoy, jorgeatorres, joshheald, jsnajdr, kalessil, kaushikasomaiya, keoshi, kidinov, kmanijak, Konamiman, kraftbj, lancewillett, layoutd, lysyjan, m1r0, MagicGeny, malinajirka, mcliwanow, mgascam, millerf, mordeth, MrJnrman, NeosinneR, nerrad, nicomollet, noruzzamans, oaratovskyi, opr, oxfordmetadata, poligilad-auto, R1shabh-Gupta, raicem, ralucaStan, rtio, s-a-s-k-i-a, Saggre, samiuelson, senadir, shsajalchowdhury, soroush5, sunyatasattva, superdav42, szepeviktor, thilinah, tjcafferkey, triple0t, vbelolapotkov, vladolaru, webdados, wehamed, wjrosa, xristos3490, yuliyan, ZebaAfiaShama