Between October 16 and October 31, 2025, WooCommerce 10.3 moved Cost of Goods Sold into core and opened a beta of the WooCommerce MCP integration, followed by the quick fix releases 10.3.1 through 10.3.3, and Oracle shipped its October 2025 MySQL security update. Act on this first: stores should be on 10.3.3 or later, which fixes a race condition that could delete processing or completed orders during cart cleanup.
Below is a quick summary table, then a section on the release covering what shipped, what it means for you, how we use it in WordPress builds, what it means for mobile apps and what to do next.
At a glance
| Release | Date | Type | Who should care | Action |
|---|---|---|---|---|
| MySQL October 2025 Critical Patch Update | Oct 21 | Security | Sites on MySQL | Apply 8.4.7 or later |
| WooCommerce 10.3 | Oct 22 | Feature | Every WooCommerce store, especially stores that use the bundled PayPal integration | See standalone post |
| WooCommerce 10.3.1 to 10.3.3 | Oct 23 to Oct 24 | Fix release | Every store on 10.3, especially stores using the bundled PayPal integration | Update to 10.3.3 |
MySQL October 2025 Critical Patch Update
What shipped
Oracle published its October 2025 Critical Patch Update on October 21, 2025. For MySQL it lists:
- 18 MySQL patches, 7 of them remotely exploitable without authentication
- Fixed releases: MySQL 8.4.7 LTS, 9.5.0 Innovation and 8.0.44
- 9 risk matrix rows that affect MySQL Server, including CVE-2025-53054 in InnoDB
What it means for you
WordPress stores all of its content, users and orders in MySQL or MariaDB, so a database security patch protects the whole site.
How we use it in WordPress builds
On the hosting we manage, we apply database patches during a low traffic window after a fresh backup, then check that WordPress, WooCommerce orders and any custom tables read and write normally.
What it means for mobile apps
This is a server side change. It does not change how an AppPresser app is built, but your app reads its content and login sessions from your WordPress site, so the same patch protects the app's data too.
What to do next
- Ask your host which MySQL version your site runs.
- Move to 8.4.7, 9.5.0 or 8.0.44 or later.
- Our WordPress security and hosting plans include database patching.
WooCommerce 10.3: Cost of Goods Sold and an MCP beta
WooCommerce 10.3 was released on October 22, 2025. It moves Cost of Goods Sold into core, opens a beta of the WooCommerce MCP integration, adds address autocomplete to both checkout types and moves the built in PayPal integration to the PayPal Orders v2 API. It still requires WordPress 6.7 and PHP 7.4.
For the full write up, read our standalone post: WooCommerce 10.3: Cost of Goods Sold and an MCP beta.
WooCommerce 10.3.1 to 10.3.3 fixes
What shipped
WooCommerce 10.3.1 and 10.3.2 were released on October 23, 2025, and 10.3.3 followed on October 24. The fixes include a race condition that could delete processing or completed orders during cart cleanup, PayPal order failures caused by an AMOUNT_MISMATCH error when fees were present, a check so PayPal capture only runs on PayPal orders, and backwards compatibility with deprecation warnings for extensions that still enqueue unprefixed script handles.
What it means for you
A bug that can remove paid orders goes to the front of the queue, which is why 10.3.3 is the release to be on rather than 10.3.0.
How we use it in WordPress builds
For stores on our plans, we confirm the store runs 10.3.3 or later, then compare recent order counts against payment gateway records to make sure nothing went missing while 10.3.0 was installed. On stores with the bundled PayPal option, we run sandbox purchases with fees applied.
What it means for mobile apps
App backends that read orders through the REST API should be checked against the same order counts, so app order history matches the store.
What to do next
- Update to WooCommerce 10.3.3 or later.
- Compare recent orders against your payment gateway records.
- Let our support and maintenance team handle staged WooCommerce updates for you.
How AlphaWeb handles updates for you
One release line in two weeks, but three fix releases in two days is a reminder that the first version of a WooCommerce release is rarely the one to stop at. Our support and maintenance plans cover tested WordPress core, theme and plugin updates on staging first, then in production, with uptime monitoring and help when something breaks. Our WordPress security and hosting service keeps PHP versions and servers current, and our custom WordPress development and custom mobile apps teams put new features to work when they fit.
We also track the server, app platform and payment releases behind your site and app, including MySQL. Our WordPress security and hosting plans keep servers and databases patched, and our mobile app team handles SDK, policy and store changes for AppPresser and Ionic apps.
Request a custom development quote, or tell us about your project through our Mission Brief.
Frequently asked questions
Does a MySQL patch need a WordPress update too?
No. MySQL runs on the server, separately from WordPress. Your host or server team applies it, and WordPress keeps working with the patched version.
Brief Us on Your Mission
Want to talk about a website, mobile app, migration or AI project? Fill out the Mission Brief and a specialist will follow up to schedule a call and put together a free quote.
