WooCommerce 10.9.4: Issues to Check Before Updating

WooCommerce 10.9.4 was released on July 7, 2026. The WordPress.org plugin page lists more than 7 million active installations, PHP 7.4 or higher, WordPress 6.9 or higher, and compatibility tested up to WordPress 7.0.1.

The WooCommerce developer blog also shows WooCommerce 11.0 in beta, with performance and account changes coming next. That means store owners should update 10.9.4 carefully while extension makers prepare for the next branch.

• Current WordPress.org version: WooCommerce 10.9.4.
• Latest fix: VAT exemption logic in block checkout.
• Security update flag: no, according to WooCommerce release notes.
• Main risk area: checkout, tax, payments, email, subscriptions, and extensions.

The update may be small, but WooCommerce stores are complex. A checkout extension, payment gateway, tax plugin, shipping plugin, subscription system, or custom order workflow can be more fragile than WooCommerce core.

Do not stop at opening the homepage. The test is only useful if a real order path works from product page to payment confirmation.

• Block checkout should calculate VAT exemption correctly for logged-in users.
• Payment gateways should load, authorize, and return to the store correctly.
• Order emails should send and show correct totals.
• Subscriptions, coupons, taxes, shipping, and multicurrency extensions should be tested.
• Fatal errors can appear when older filters or email customizations conflict with newer WooCommerce code.

1. Back up files and database before touching production.
2. Test the update on staging with the same payment and shipping extensions.
3. Confirm WordPress, PHP, theme, and WooCommerce extensions meet requirements.
4. Run test orders for guest checkout, logged-in checkout, coupon use, tax, shipping, and refunds.
5. Check order emails, webhooks, payment callbacks, analytics pixels, and inventory updates.
6. Clear cache and retest checkout from a logged-out browser.
7. Run a Fixnx scan after release to catch public exposure or SEO changes.

A Fixnx scan after a WooCommerce update might show that checkout works, but the store exposes old payment gateway assets and missing security headers.

That means the store can still take orders, but it is leaking useful information and missing browser protections around sensitive pages.

• Evidence: public plugin paths reveal payment and checkout extensions.
• Impact: attackers can focus on high-value commerce components.
• Fix: update payment extensions, remove unused plugins, and harden headers.
• Retest: confirm checkout, webhook callbacks, and scan findings after caches clear.

1. Fix checkout, payment, tax, shipping, and order email problems first.
2. Patch payment gateway and subscription extensions before low-risk UI plugins.
3. Remove unused WooCommerce extensions that still load public assets.
4. Check customer account pages, refunds, coupons, and inventory sync.
5. Improve headers, HTTPS, cookie flags, and exposed plugin files after revenue flow is stable.