WooCommerce 11.1.1 landed Friday afternoon (18th Sep 2026), fifteen days after 11.1.0. A point release on Friday usually signals one thing: security fixes. This one is no exception. There are no new features and no database changes, so it is a straightforward update. It looks like the reason Automattic pushed it out is to beat the feature freeze for WooCommrece 11.2, which is due early October.
REST API key authentication
WooCommerce has to decide whether each incoming request is a call to its REST API, because that decides whether its API keys are checked. On sites using plain permalinks, the route can be passed as a ?rest_route= query parameter. 11.1.0 trusted that parameter without confirming WordPress was actually handling a REST request. 11.1.1 only trusts it once WordPress confirms genuine REST dispatch.
If your integrations use the REST API in the normal way, nothing changes for you.
The legacy Options API
/wc-admin/options has been deprecated since WooCommerce 6.3, but it was still there. On a production site, any user with the manage_options capability could update any WordPress option through it. It now refuses every option that is not on WooCommerce’s own allowlist, and it no longer returns the site name, date and time formats or theme settings.
If you have custom code that quietly used this endpoint to change site settings, it will stop working. That code was living on borrowed time.
Mobile app QR login
WooCommerce admin can show a QR code that logs the WooCommerce mobile app in. The endpoints that create those login tokens used to check only that the user could manage WooCommerce. They now also require a real logged-in browser session and a valid nonce, so a request authenticated some other way, such as an application password, can no longer mint a login token for the app.
Guest sessions
An earlier release changed how guest session cookies are signed, and kept a fallback so older cookies would still work. 11.1.1 removes that fallback. The practical effect is that a few logged-out shoppers with old cookies will be given a fresh session, which means an old cart may come back empty. Not ideal, but it is a one-off.
A Mini Cart fix
The only non-security change. On pages where the Mini Cart block itself is not loaded, the cart drawer contents could render without any styling, below the footer. It has its own stylesheet again.
Updating
At the time of writing, wordpress.org was still processing the release, so wp plugin update didn’t offer it yet. Installing over the top works fine though:
# Force installing the latest version wp plugin install woocommerce --force # Verify version 11.1.1 is now installed wp plugin list --name=woocommerce --fields=name,version
Straight after the upgrade you may see a single database error in your PHP log along these lines:
WordPress database error Duplicate entry 'wc_installing' for key 'PRIMARY' ... WC_Install::create_lockIt looks alarming but it is harmless. WooCommerce uses that row as a lock so that only one request runs the upgrade routine. When a second request arrives mid-upgrade, the insert fails, WordPress logs it, and the second request backs off. If you still have a wc_installing option ten minutes later, that is worth a look. One log line on its own is not.
I couldn’t find any CVE or severity ratings for these fixes, so these feel more like security housekeeping than anything else. But it’s still good practice to update immediately.
NOTE: If your site is hosted on our network, you don’t need to take any action.
NOTE: If you have external integrations that talk to WooCommerce’s older APIs (e.g. shipping fulfilment systems), test them after updating.