WooCommerce Quietly Mentions Website Could Be Hijacked Between Fixes for Button Alignment and Product Attribute Sorting
In a routine update released this week, WooCommerce announced several important improvements, including respecting custom product-term order, properly centering buttons, and preventing attackers from potentially injecting malicious PHP objects through crafted cached data.
The security fix appeared fifth in the list, nestled comfortably between “admin button styles looked weird” and “cancelled-order emails weren’t being sent,” ensuring nobody would become unnecessarily alarmed by the words PHP Object Injection.
“Some updates contain urgent security patches,” said a WooCommerce spokesperson while slowly sliding the changelog underneath a stack of packing slips. “This one primarily improves the order in which shirt sizes appear. Also, under extremely specific circumstances, someone may have been able to weaponize serialized data inside your online store. Anyway, medium now comes before large.”
Developers confirmed the vulnerability was addressed by passing allowed_classes => false to unserialize(), a technical security measure carefully presented with the same emotional urgency as fixing an email address that had been “texturized.”
The full update also prevents inventory from remaining permanently reduced, stops deleted orders from repeatedly emailing customers, limits database-hammering Store API requests, and introduces a database lock so background processors no longer “silently drop or resurrect themselves,” another phrase apparently deemed too ordinary to warrant a warning banner.
WooCommerce administrators are encouraged to update immediately—or whenever they finish investigating why every icon-and-text button in the dashboard was mysteriously centered.