Between March 1 and March 15, 2026, WordPress shipped 6.9.2, 6.9.3 and 6.9.4, WooCommerce shipped the 10.5.3 security patch and 10.6 with its 10.6.1 follow up, and Angular fixed an XSS in i18n attribute bindings. Act on these first: every WordPress site should end up on 6.9.4, which completes the 6.9.2 security fixes, and every WooCommerce store on 5.4 through 10.5.2 needs the 10.5.3 patch for its branch.
Below is a quick summary table, then a section for each release covering what shipped, what it means for you, how we use it in WordPress builds, what it means for mobile apps and what to do next. Each WordPress core release gets a short summary here and a link to its own post.
At a glance
| Release | Date | Type | Who should care | Action |
|---|---|---|---|---|
| WordPress 6.9.2 | Mar 10 | Security | Every WordPress site | Update now (to 6.9.4) |
| WordPress 6.9.3 | Mar 10 | Bug fix | Sites that went blank after 6.9.2 | Update now (to 6.9.4) |
| WordPress 6.9.4 | Mar 11 | Security | Every WordPress site | Update now |
| WooCommerce 10.5.3 | Mar 2 | Security | Every store on WooCommerce 5.4 through 10.5.2 | Update now |
| WooCommerce 10.6 | Mar 10 | Feature | Every WooCommerce store, especially EU sellers and large catalogs | See standalone post |
| WooCommerce 10.6.1 | Mar 12 | Fix release | Every store on 10.6 | Update to 10.6.1 |
| Angular security advisories | Mar 13 | Security | Angular, Ionic Angular and SSR front ends | Update Angular packages |
WordPress 6.9.2 security release
WordPress 6.9.2 was released on March 10, 2026, to fix 10 security issues, including a blind SSRF, a stored XSS in nav menus, a PclZip path traversal and an authorization bypass on Notes. The fixes were backported to every eligible branch back to 4.7, and the WordPress Security Team recommends updating immediately. Keep going to 6.9.4, which completes several of these fixes.
For the full write up, read our standalone post: WordPress 6.9.2 Patches 10 Security Issues Including SSRF and XSS.
WordPress 6.9.3 fixes the blank front end bug
WordPress 6.9.3 was released on March 10, 2026, the same day as 6.9.2, to fix a blank front end on some sites whose themes load template files through stringable objects. It keeps all of the 6.9.2 security fixes, so a site that went blank after 6.9.2 should be restored by this update.
For the full write up, read our standalone post: WordPress 6.9.3 Fixes the Blank Front End Bug After 6.9.2.
WordPress 6.9.4 security release
WordPress 6.9.4 was released on March 11, 2026, because not all of the 6.9.2 security fixes had been fully applied. It completes the fixes for the PclZip path traversal, the Notes authorization bypass and the getID3 XXE. Every site should end up on 6.9.4 or later.
For the full write up, read our standalone post: WordPress 6.9.4 Completes the PclZip, Notes and getID3 Security Fixes.
WooCommerce 10.5.3 security release
What shipped
WooCommerce 10.5.3 was released on March 2, 2026. It fixes a cross site request forgery (CSRF) vulnerability in the Store API batch endpoint that, under specific conditions, could let an attacker create administrator accounts.
The vulnerability affected WooCommerce 5.4 through 10.5.2. WooCommerce described it as a critical phishing vulnerability: a logged in administrator would have to visit a malicious link under specific browser circumstances, namely a browser other than Chrome or an older version of Chrome with a particular flag enabled. If exploited, it could trigger actions such as creating admin accounts or posts. The National Vulnerability Database lists it as CVE-2026-3589.
The fix parses each batch request path and confirms it starts with /wc/store, so batch requests can only reach Store API endpoints. WooCommerce released patches for all 52 affected versions and began automatic updates through WordPress.org at 14:00 UTC on March 2, 2026 for stores opted in to auto updates. As with the December 2025 Store API fix, WooCommerce stores on Automattic hosting (WordPress.com, WordPress VIP, Pressable and WP Cloud) received the patch automatically. WooCommerce 5.3 and earlier were not affected.
What it means for you
WooCommerce said it had no evidence of exploitation outside its own security testing and that no passwords, credit cards or other financial details would have been exposed. The stores at risk were those on WooCommerce 5.4 through 10.5.2 whose logged in administrators visited a malicious link under the specific browser conditions described in the advisory.
How we use it in WordPress builds
Admins who browse from the dashboard. Because this attack depended on an administrator clicking a link, we pair the update with a quick review of who holds administrator access. On client stores, we remove admin accounts that are no longer needed and look for any unexpected administrator created around the advisory date.
Older branches still in use. Some stores stay on an older WooCommerce line because a critical extension has not caught up. For those clients, we install the patched release for their exact branch, confirm the version on the Plugins screen and record the extension that is holding them back so we can plan the larger upgrade.
What it means for mobile apps
The flaw was in the Store API batch endpoint, which the fix now limits to Store API paths. The advisory lists no app specific changes. AppPresser apps that run checkout through your store are covered by the store update, and we place a test order in the app after patching to confirm the cart and checkout still work.
What to do next
Install 10.5.3, or the patched release for your branch, and confirm the version on the Plugins screen. Our support and maintenance plans include same day attention for WooCommerce security releases like 10.5.3, user access reviews and post update checks. If you would like us to review admin accounts on your store, contact us.
WooCommerce 10.6
WooCommerce 10.6 was released on March 10, 2026, with easier Product Collection setup, polished Cart and Checkout blocks, fewer database queries on admin and product pages and a filter for tax inclusive shipping prices. Minimum requirements stay at WordPress 6.8 and PHP 7.4.
For the full write up, read our standalone post: WooCommerce 10.6.
WooCommerce 10.6.1 fixes
What shipped
WooCommerce 10.6.1 was released on March 12, 2026. It fixes variation options being disabled in the Add to Cart with Options block when attribute slugs contain hyphens, places newly installed payment gateways above offline payment methods so they can be expanded by default at checkout, and labels a single shipping package "Shipment" instead of "Shipment 1" in the shortcode checkout.
What it means for you
The order of payment methods affects which one shoppers pick, and 10.6.1 changes where newly installed gateways appear. Stores with hyphenated attribute slugs get their variation options back.
How we use it in WordPress builds
After installing 10.6.1 we review the payment settings screen with the client and confirm the gateway they want first is at the top of checkout, then test variable products that use hyphenated attributes.
What it means for mobile apps
Store apps that load the checkout show the same payment order, so we check the payment list inside the app after the update.
What to do next
- Install WooCommerce 10.6.1.
- Confirm the order of payment methods at checkout.
- Let our support and maintenance team test and apply it for you.
Angular security advisories
What shipped
The Angular team published these security advisories in this period:
- CVE-2026-32635 (high): XSS in i18n attribute bindings, in @angular/core and @angular/compiler
- No fix is provided for Angular 17 and 18
What it means for you
These flaws are in the Angular framework, not in WordPress. They matter if you run an Angular front end, an Ionic Angular app or server side rendering in front of WordPress.
How we use it in WordPress builds
On headless WordPress front ends built with Angular, we update the @angular packages to the fixed version for the project's major line and rerun rendering, login and form tests.
What it means for mobile apps
Ionic Angular apps ship Angular inside the app, so a fix for code that runs in the app needs a rebuild and a new store submission.
What to do next
- Update to Angular 21.2.4, 20.3.18 or 19.2.20 or later.
- Ask our mobile app team to rebuild and resubmit an affected app.
How AlphaWeb handles updates for you
Five releases in two weeks, four of them security or fast follow fixes, is exactly the kind of stretch where a missed step leaves a site exposed. Our support and maintenance plans cover tested WordPress core, theme and plugin updates on staging first, then in production, with uptime monitoring and help when something breaks. Our WordPress security and hosting service keeps PHP versions and servers current, and our custom WordPress development and custom mobile apps teams put new features to work when they fit.
We also track the server, app platform and payment releases behind your site and app, including Angular. Our WordPress security and hosting plans keep servers and databases patched, and our mobile app team handles SDK, policy and store changes for AppPresser and Ionic apps.
Request a custom development quote, or tell us about your project through our Mission Brief.
Brief Us on Your Mission
Want to talk about a website, mobile app, migration or AI project? Fill out the Mission Brief and a specialist will follow up to schedule a call and put together a free quote.
