WooCommerce 10.7.0 was released on April 14, 2026. WooCommerce describes it as some of its most significant query reduction work, and the release also disables HPOS sync on read by default, extends the Fulfillments beta and includes security hardening.
The release lists 175 pull requests from 66 contributors, includes a database update and is marked as including security updates. Minimum requirements remain WordPress 6.8 and PHP 7.4.
HPOS order queries cut by 51 percent
The /wc/v4/orders REST endpoint previously ran 271 database queries per request on HPOS stores because of N+1 query patterns. Cache priming now preloads order data in bulk and brings that down to 132, a 51% reduction. Checkout also persists draft orders with fewer queries: WooCommerce reports a drop from 204 to 172 queries without an object cache and from 127 to as low as 115 with one. New indexes were added to the shipping zone methods table, and the Store API caches the products endpoint's Last-Modified timestamp.
Order heavy integrations. Stores that sync orders to fulfillment, accounting or CRM systems through the REST API feel these query savings most. We run the client's integration against a staging copy before and after the update, checking that order data still arrives complete and noting the difference in response times.
HPOS sync on read is switched off by default in 10.7
On stores with HPOS and compatibility mode enabled, sync on read used to pull changes made directly to the posts table back into the HPOS tables. WooCommerce 10.7 disables it by default and shows a one time admin notice on affected stores. Code or plugins that write order data with wp_update_post, update_post_meta or direct SQL may stop seeing those changes in orders. The woocommerce_hpos_enable_sync_on_read filter can re-enable it temporarily, but WooCommerce says it may be removed entirely in a future version.
Plugins that write orders the old way. This is the 10.7 change we test hardest. We search client plugins and custom code for direct writes to order posts, run each order workflow on staging with sync on read off and move any custom code to the WooCommerce CRUD layer. Where a third party extension still depends on the old behavior, we use the filter as a short term bridge and ask the vendor for an update.
Fulfillments beta gains custom shipping providers
The Fulfillments beta gets typed PHP methods for tracking numbers and shipping providers, a dedicated order note group and a data store that extensions can override. Merchants can define custom shipping providers with tracking URL templates under Settings, Shipping, Shipping Providers, and the orders list gains a provider filter.
Tracking links for regional carriers. Many stores ship with carriers that tracking plugins do not cover. If a client wants to try Fulfillments, we add their carriers with tracking URL templates on staging, send a test shipment notification and confirm the link opens the right tracking page before suggesting it for live orders.
Security hardening, analytics exports and accessibility in 10.7
- The v4 REST API order notes endpoint now filters notes with
wp_kses_post(), matching v1 to v3 - Product and term ordering AJAX handlers now verify a nonce with
check_ajax_referer() - Payment gateway password fields are trimmed instead of sanitized, so
%characters are no longer stripped - Analytics exports forward currency and custom filter parameters to background jobs and add column and row filters
- System Status indicators and several dashboard and checkout elements meet WCAG 2.2 AA contrast
- The payment method radio button always shows, even with a single payment method
Gateway credentials after the update. Because gateway password fields are now trimmed rather than sanitized, a password containing a percent sign may start working differently. We run a live or sandbox transaction on each gateway after updating to confirm the stored credentials still authenticate.
The experimental email editor and API changes in 10.7
The block based email editor, still behind a feature flag, renders WordPress embeds as rich cards with a featured image, title, excerpt and site icon, capped at five per email. In the REST API, customer username and password fields are always optional and generated when empty, and refund amount checks use proper precision rounding.
WooCommerce 10.7 FAQ
Does WooCommerce 10.7 include security fixes?
Yes. The release notes state that 10.7 includes security updates, including XSS filtering on v4 order notes and nonce checks on product and term ordering.
Will disabling sync on read affect my store?
Only stores with HPOS and compatibility mode enabled that rely on code writing order data directly to the posts table. Affected stores see a one time admin notice.
Can I turn sync on read back on?
Yes, temporarily, with the woocommerce_hpos_enable_sync_on_read filter.
Worried about HPOS sync on read or order integrations in WooCommerce 10.7? Our support and maintenance plans include code reviews for order handling, staged updates and integration testing. Contact us to set up a review.
