Thursday, October 15, 2026
News For Internet Marketers
WooCommerce 11.2.0, released October 7, 2026, fixes CVE-2026-106608, which let shop managers take over multi-role accounts including some administrators, and adds four other security changes. 11.2.1 followed on October 9 with checkout fixes.
Restricted sellers shut out of Shopify Payments pay a plan-based surcharge on every gateway order, including tax and shipping, with no refund on returns. This analysis models the plan crossovers, the ENDS removal, and when self-hosting pays back.
Platform payment bans and Shop-channel limits push many firearms accessory merchants off Shopify Payments. This analysis weighs WooCommerce and BigCommerce for SKU control, age gates, and specialty gateway integrations before peak season.
After Square's October 15 CBD catalog deadline and November 5 hemp-primary closure pattern, Shopify and WooCommerce stores need underwriting, dual-MID, plugin, ACH, and chargeback criteria before they trust any specialty gateway marketing page.
After active exploitation of WooCommerce Wholesale Lead Capture CVE-2026-27540, high-risk stores need file integrity monitoring on uploads, checkout templates, and admin users before acquirers ask for forensics.
Unauthenticated file upload CVE-2026-27540 in WooCommerce Wholesale Lead Capture is under active exploitation. Update to 2.0.3.2 and inspect uploads.
