WooCommerce 11.2.2: Release notes

What’s in this release

WooCommerce 11.2.2 is a security release with multiple security updates. We strongly recommend updating as soon as possible. This release contains:

• Additional hardening of Store API cart item quantities, REST API key authentication, and checkout tax calculation for local pickup.
• Hardened how product default attributes are updated when a global attribute term is renamed, and how they are read. This release includes a database update to clean up affected data.
• Hardened Store API checkout so an order that could not be saved does not go on to payment.
• Hardened the decoding of payments profile data.
• Improved validation of the product CSV importer’s column mapping.
• Hardened the admin connection endpoints.
• Each Store API checkout request now starts with its own order and payment data.
• The cart now ignores attributes that the product does not use when a shopper adds it.
• Fixed PayPal Standard shipping address updates so shipping and tax are recalculated correctly.

Additional Notes

• Store API checkout now stops if the order fails to save. If an extension’s callback on woocommerce_before_order_object_save, woocommerce_new_order, or woocommerce_update_order throws during Store API checkout, checkout now returns a 500 error. Before, it carried on with a partially saved order. save() itself still does not throw.
• Two wc-admin connection endpoints now require an administrator browser session. onboarding/plugins/jetpack-authorization-url and plugins/connect-jetpack now need a logged-in cookie and a wp_rest nonce on top of the capability check. Requests using REST API keys, WP-CLI, or application passwords get a 403. The wc-admin client isn’t affected.