Between December 16 and December 31, 2025, WooCommerce shipped the 10.4.3 security fix, PHP shipped the 8.5.1, 8.4.16, 8.3.29, 8.2.30 and 8.1.34 security releases, PHP 8.1 reached end of life, and Apple paused its Texas age assurance plans. Act on the two security releases first, then put any site still on PHP 8.1 on an upgrade schedule.
Below is a quick summary table, then a section for each release covering what shipped, what it means for you, how we use it in WordPress builds, what it means for mobile apps and what to do next.
At a glance
| Release | Date | Type | Who should care | Action |
|---|---|---|---|---|
| WooCommerce 10.4.3 | Dec 22 | Security | Every store on WooCommerce 8.1 through 10.4.2, especially stores with guest checkout | Update now |
| PHP 8.5.1 and 8.4.16 security releases | Dec 18 | Security | Every site on a supported PHP branch | Update now |
| PHP 8.1 end of life | Dec 31 | End of support | Every site still on PHP 8.1 | Plan an upgrade |
| Apple Texas SB2420 update | Dec 23 | Policy | iOS app owners with Texas users | No change needed now |
WooCommerce 10.4.3 security fix
What shipped
WooCommerce 10.4.3 was released on December 22, 2025. It patches a Store API vulnerability that let logged in customers view order details belonging to guest customers, and WooCommerce rated it critical in its advisory.
The issue affected WooCommerce 8.1 through 10.4.2. Through a specific Store API endpoint, a logged in customer could retrieve a guest order by its order ID without the order key or billing email that a guest would normally need. It was reported by GitHub Security Lab team members Man Yue Mo and Peter Stöckli through the Automattic bug bounty program and is tracked as GHSL-2025-129 and CVE-2025-15033.
WooCommerce built patches for all 23 affected versions and worked with the WordPress.org Plugins Team on automatic updates, which began rolling out at 16:00 UTC on December 22, 2025 to stores opted in to auto updates. Stores hosted by Automattic, including WordPress.com, WordPress VIP, Pressable and WP Cloud, were updated or patched automatically. Stores on WooCommerce 8.0 or earlier were not affected.
Other fixes bundled into 10.4.3:
- The "Undo" link after removing an item from the shortcode cart works again
- An HPOS sync on read loop was resolved
- Bulgarian stores switch automatically from BGN to EUR on January 1, 2026, the date Bulgaria adopts the euro
What it means for you
Exposed details could include names, email addresses, phone numbers, shipping and billing addresses, payment method types, items purchased and related metadata such as product customizations. WooCommerce said no credit card or other financial details were exposed and that it had no evidence the vulnerability was exploited outside its own security testing.
Guest checkout is common on the stores we support, which puts this issue squarely in scope for most stores.
How we use it in WordPress builds
Checking auto updates actually ran. Many hosts and maintenance setups block plugin auto updates, so we do not assume the rollout reached every store. We read the installed version on each site directly and update by hand where needed, then run a test purchase as a guest and as a logged in customer to confirm checkout still behaves.
Bulgarian stores and the euro switch. An automatic currency change affects prices, reports and gateway settings at once. For any store selling from Bulgaria, we would review product prices, shipping rates and payment gateway currency settings after the switch and check that historical orders still report in the currency they were placed in.
What it means for mobile apps
The flaw was in a Store API endpoint, and the fix is in the store itself, so AppPresser apps that show orders or run checkout through your store are covered once the store is patched. The advisory lists no app specific changes. The test purchase as a guest and as a logged in customer is the check we repeat in apps with in app checkout.
What to do next
Confirm each store is on 10.4.3 or the patched release for its branch. For any store still on an older line, check the version table WooCommerce published rather than assuming an auto update had run. Our support and maintenance plans include version checks after every WooCommerce security advisory, hands on updates where auto updates are blocked and post update checkout testing. If you are unsure whether your store is patched, contact us.
PHP 8.5.1 and 8.4.16 security releases
What shipped
PHP 8.5.1, 8.4.16, 8.3.29, 8.2.30 and 8.1.34 were released on December 18, 2025. php.net describes each of them as a security release and encourages all users of those branches to upgrade. According to the official ChangeLog, the same four security advisories were fixed on every supported branch:
- A heap buffer overflow in array_merge() (CVE-2025-14178)
- An information leak of memory in getimagesize() (CVE-2025-14177)
- A null pointer dereference in the PDO quoting result (CVE-2025-14180)
- A null byte termination issue in dns_get_record()
PHP 8.5.1 also fixed CVE-2025-67899, unbounded recursion in the bundled uriparser library used by the new URI extension, and a set of bug fixes, including a regression that broke MySQL connections to an IPv6 address written in square brackets.
What it means for you
PHP updates are applied by whoever manages your server, not from the WordPress dashboard. On managed hosting, the host usually rolls them out; on a VPS or dedicated server, someone has to install them. Either way, it is worth confirming the version after the update.
Heap buffer overflow in array_merge(). array_merge() is one of the most used functions in PHP, and WordPress, themes and plugins call it constantly. A memory safety bug in a function that common is worth closing quickly, even without a known attack against WordPress.
Memory leak in getimagesize(). WordPress reads image dimensions with getimagesize() through its own wp_getimagesize() wrapper, so the function runs whenever images are uploaded or processed. A leak of memory contents through crafted images matters most on sites that accept uploads from the public or from many contributors.
How we use it in WordPress builds
PDO quoting null dereference. WordPress core talks to its database through mysqli rather than PDO, but many custom applications, headless backends and some plugins use PDO. A null pointer dereference can crash a PHP worker, which shows up as errors or slow pages. When a client runs PDO based code alongside WordPress, we include it in our post update testing.
Null byte termination in dns_get_record(). dns_get_record() looks up DNS records, and plugins use it for email deliverability checks, domain verification and security tools. Mishandled null bytes can make those lookups return the wrong result. If your site uses features like these, we test them after the update so that verification and email checks still behave correctly.
MySQL connections over bracketed IPv6. Some hosting setups put the database server on an IPv6 address, written in square brackets in the database host setting. A regression in PHP 8.5.0 broke those connections, and 8.5.1 fixes it. For sites we move to PHP 8.5, we check the database host setting and make sure the site is on 8.5.1 or later before switching.
What it means for mobile apps
The ChangeLog lists fixes to PHP on the server and no app specific changes. AppPresser apps load content from your WordPress site, so the patched server protects them too. Because getimagesize() runs whenever images are processed, we include images uploaded or shown through the app in the post update image test.
What to do next
We confirm that every server we manage is on a patched build and run a quick smoke test of the front end and admin afterward. After patching, we test image uploads, thumbnails and the media library on staging. Want PHP security releases checked and applied for you? Our support and maintenance plans cover server and PHP updates, tested WordPress updates and uptime monitoring, and our WordPress security and hosting service applies server patches on the servers we run.
PHP 8.1 end of life
What shipped
PHP 8.1 reached end of life on December 31, 2025. According to php.net, the final release of the branch was PHP 8.1.34 on December 18, 2025, and branches past end of life no longer receive security fixes from the PHP project.
php.net's supported versions page explains that each PHP branch gets two years of active support, with regular bug fix and security releases, followed by two years of security fixes only. After that, the branch is unsupported, and users are advised to upgrade as soon as possible because they may be exposed to unpatched vulnerabilities. According to php.net, these branches remain supported:
- PHP 8.2: security fixes only, until December 31, 2026
- PHP 8.3: security fixes only, until December 31, 2027 (its active support ended on December 31, 2025)
- PHP 8.4: active support until December 31, 2026, security fixes until December 31, 2028
- PHP 8.5: active support until December 31, 2027, security fixes until December 31, 2029
According to the WordPress PHP compatibility handbook, WordPress 6.9 is compatible with PHP 7.2 through 8.4 and has beta support for PHP 8.5.
What it means for you
Your site will keep running on PHP 8.1, which is why end of life is easy to ignore. The risk is what happens next: when a vulnerability is found in PHP, supported branches get a fix and 8.1 does not.
You can see the PHP version your site runs under Tools, then Site Health, then Info, then Server. Many hosting control panels show the same information.
How we use it in WordPress builds
Jumping from 8.1 to 8.2 buys only one more year before the same problem returns. For most client sites we aim for PHP 8.3 or 8.4, which have years of security support left and are well tested with WordPress, themes and plugins. We pick the target per site, based on what the host offers and what the plugin list supports, and write down the reason so the next upgrade is easier.
Plugin and theme compatibility audit. WordPress core runs fine on newer PHP, but a theme or plugin that has not been updated in years may not. Before an upgrade, we check each plugin's tested versions and recent updates, run the site on the new PHP version in staging and read the error log. Abandoned plugins get replaced, and custom code we wrote gets fixed before the switch.
When we take on a new client, we record the PHP version of every site and environment, including staging, because staging servers are often older than production and can hide problems until launch day.
What it means for mobile apps
The PHP version runs on the server behind your WordPress site, so an AppPresser app is affected through the site it loads content from. Once the site moves off PHP 8.1, we check the app screens that pull content from the site as part of the post upgrade test.
What to do next
Sites still on 8.1 need a plan, not a rushed switch. We list every client site by PHP version, test the ones on 8.1 against a newer branch on staging and schedule each upgrade with the host so it happens on a quiet day. For sites we manage, we treat PHP 8.1 as a scheduled project rather than an emergency, and we give each client a date for their upgrade instead of an open ended warning. On managed hosting, changing PHP is often a setting in the control panel; on older plans, it can require a move to a newer server. We confirm what your host offers, schedule the change for a low traffic window, keep a backup ready and verify the site on the new version right after it goes live. Our WordPress security and hosting service can move your site to a modern server if needed. Contact us to plan it.
Apple pauses Texas age assurance plans
What shipped
On December 23, 2025, Apple posted an update on Texas law SB2420. Apple's post states:
- A court issued an injunction that blocks the Texas law
- Apple paused its plans to put the Texas requirements in place
- The Declared Age Range API and related tools remain available to developers
- Apple noted the same tools can help with age laws taking effect in Utah and Louisiana in 2026
What it means for you
You do not need to change your app for Texas right now. The Utah and Louisiana laws are still coming, so the age tools are still worth understanding.
How we use it in WordPress builds
No WordPress change is needed.
What it means for mobile apps
For AppPresser apps, we are holding any age signal work until a client's audience or a state law requires it.
What to do next
- Keep your current app build
- Watch Apple developer news for the Utah and Louisiana dates
- Ask us during your next App Store submission review
How AlphaWeb handles updates for you
The last two weeks of 2025 brought two security releases and a PHP end of life date, and each one needs a different kind of attention. Our support and maintenance plans cover tested WordPress core, theme and plugin updates on staging first, then in production, with uptime monitoring and help when something breaks. Our WordPress security and hosting service keeps PHP versions and servers current, and our custom WordPress development and custom mobile apps teams put new features to work when they fit.
We also track the server, app platform and payment releases behind your site and app, including App Store. Our WordPress security and hosting plans keep servers and databases patched, and our mobile app team handles SDK, policy and store changes for AppPresser and Ionic apps.
Request a custom development quote, or tell us about your project through our Mission Brief.
Brief Us on Your Mission
Want to talk about a website, mobile app, migration or AI project? Fill out the Mission Brief and a specialist will follow up to schedule a call and put together a free quote.
