• Skip to main content
  • Skip to footer

7th Circle Designs

Building, Securing, and Optimizing WordPress Since 2014

  • Training and Coaching
    • Online WordPress Training and Coaching
    • Virtual Meeting
    • eLearning
  • Services
    • WordPress Security Audit
    • WordPress Site Design
      • WordPress Site
      • WordPress Membership Site
      • WordPress eCommerce Site
      • CPA Web Package
    • WordPress Care Plans
    • Search Engine Optimization and Branding
      • Personal Branding Package
      • Business Branding Package
      • Search Engine Optimization
    • Information Technology
  • Plugins
    • E-mail
    • Easy Digital Downloads
    • Genesis
    • Modern Tribe Events
    • Optimization and Tweaking
    • Personalization and Branding
    • Security
    • SEO
    • WooCommerce
  • Blog
  • Contact Us
  • Login
  • Cart

Important Security Patch Released in WooCommerce

September 21, 2021 by 7th Circle Designs Leave a Comment

On September 21, 2021, our team released a security patch to address a server configuration setup used by some hosts, which under the right conditions may make some analytics reports publicly available.

What actions should I take?

Automatic software updates began rolling out on September 21, 2021, to all stores running impacted versions of WooCommerce, but we still highly recommend you ensure that you’re using a patched version. This is 5.7.0 or the highest number possible in your release branch.

After updating to a patched version, we also recommend disabling Directory Listing on your web server, if it isn’t already. This feature displays a list of every file in the web directory when there is no index file present. You can check if this is active by visiting <domain>/wp-content/uploads in a browser. If you’re not sure how to disable this, please contact your web host directly.

How do I know if my version is up-to-date?

The table below contains the full list of patched versions of WooCommerce and WooCommerce Admin. If you are running a version of WooCommerce that is not on this list, please update immediately to the highest version in your release branch. Once you update to any of the patched versions of WooCommerce below, WooCommerce Admin should update automatically.

Patched versions of WooCommerce
– 4.0.3
– 4.1.3
– 4.2.4
– 4.3.5
– 4.4.3
– 4.5.4
– 4.6.4
– 4.7.3
– 4.8.2
– 4.9.4
– 5.0.2
– 5.1.2
– 5.2.4
– 5.3.2
– 5.4.3
– 5.5.3
– 5.6.1
– 5.7.0
Patched versions of WooCommerce Admin
– 1.0.4
– 1.1.4
– 1.2.5
– 1.3.3
– 1.4.1
– 1.5.1
– 1.6.4
– 1.7.4
– 1.8.4
– 1.9.1
– 2.0.4
– 2.1.6
– 2.2.7
– 2.3.2
– 2.4.5
– 2.5.2
– 2.6.4

Why didn’t my website get the automatic update?

Your site may not have automatically updated for a number of reasons. A few of the most likely are: you’re running a version prior to one impacted (below WooCommerce 4.0.0), automatic updates have been explicitly disabled on your site, your filesystem is read-only, or there are potentially conflicting extensions preventing the update.

In all cases (except the first example, where you are unaffected), you should attempt to manually update to the newest patched version on your release branch (e.g. 4.0.3, 4.5.4, 5.5.3, etc), as listed in the table above.

How can I check if my reports were affected?

You can check your site’s reports to see:

  • Visit <your-domain>/wp-admin/options.php and search for the woocommerce_admin_report_export_status field. If it is present, it is possible that one of the report files may have been downloaded.
  • Visit <your-domain>/wp-content/uploads in a browser. If you receive a list of files, rather than a blank page, it is possible that a report file may have been made public.

Further questions?

If you have any further concerns or questions regarding this issue, our team of Happiness Engineers is on hand to help – open a support ticket.

Reposted from WooCommerce

Filed Under: WooCommerce Security Release

Reader Interactions

Leave a Reply Cancel reply

Your email address will not be published. Required fields are marked *

This site uses Akismet to reduce spam. Learn how your comment data is processed.

Footer

Recent Posts

  • WooCommerce 6.8 Released
  • WooCommerce 6.7 Released
  • WordPress 6.0.1 Maintenance Release
  • WooCommerce 6.6.1 Fix Release
  • WooCommerce 6.6 Released

Categories

Sign up for our newsletter

This field is for validation purposes and should be left unchanged.

  • Facebook
  • Twitter
  • LinkedIn
  • Yelp
  • Sitemap
  • Terms of Service
  • Privacy Policy
  • Accessibility Statement
  • Affiliate Disclosure
  • Pay An Invoice

Buy Me A Coffee

Copyright © 2009–2022 7th Circle Designs · All Rights Reserved
Built and designed by 7th Circle Designs