WooCommerce

High

Developer: Automattic Version: 11.1.0 Last scanned: 4 september 2026 View on WordPress.org ↗

No critical findings detected by this scanner does not mean "this plugin is safe." This report is based on static analysis and cannot guarantee that the plugin is free from vulnerabilities or malicious behaviour.

Overview

Security

High

Permissions

High

External Access

Medium

Data Handling

Not yet analyzed

Code Quality

Not yet analyzed

Activation Behaviour

Medium

4 things worth reviewing

Uses capability checks in 347 locations
Contacts 3 external hosts
Registers 44 REST API routes
3 security findings require review

Scanner 0.1.0 · Ruleset 0.1.0 · Package SHA-256: 6bae9bf74d722b6d…

Permissions

manage_woocommerce — used in 104 locations
install_plugins — used in 29 locations
edit_shop_orders — used in 27 locations
manage_options — used in 22 locations
edit_products — used in 18 locations
activate_plugins — used in 11 locations
edit_posts — used in 10 locations
edit_post — used in 7 locations
edit_others_shop_orders — used in 7 locations
edit_user — used in 6 locations
jetpack_disconnect — used in 6 locations
switch_themes — used in 5 locations
read — used in 5 locations
jetpack_connect — used in 5 locations
export — used in 4 locations

Show all 43 remaining capabilities

publish_shop_orders — used in 4 locations
view_woocommerce_reports — used in 4 locations
install_themes — used in 4 locations
edit_theme_options — used in 4 locations
jetpack_connect_user — used in 4 locations
promote_users — used in 4 locations
manage_product_terms — used in 3 locations
edit_themes — used in 3 locations
edit_product — used in 3 locations
edit_comment — used in 3 locations
create_users — used in 3 locations
remove_users — used in 2 locations
import — used in 2 locations
read_product — used in 2 locations
edit_term — used in 2 locations
manage_privacy_options — used in 2 locations
read_post — used in 2 locations
pay_for_order — used in 2 locations
unfiltered_html — used in 2 locations
administrator — used in 2 locations
jetpack_unlink_user — used in 2 locations
edit_others_pages — used in 1 location
edit_others_products — used in 1 location
delete_post — used in 1 location
update_plugins — used in 1 location
order_again — used in 1 location
download_file — used in 1 location
cancel_order — used in 1 location
manage_sites — used in 1 location
edit_private_products — used in 1 location
moderate_comments — used in 1 location
view_order — used in 1 location
customer — used in 1 location
edit_users — used in 1 location
create_app_password — used in 1 location
upload_themes — used in 1 location
shop_manager — used in 1 location
publish_products — used in 1 location
update_core — used in 1 location
update_php — used in 1 location
read_private_shop_orders — used in 1 location
jetpack_manage_modules — used in 1 location
jetpack_reconnect — used in 1 location

🔒 Full details are available with a Developer or Agency plan.

File paths, line numbers, and raw evidence are part of the paid technical detail layer.

View plans

External Access

translate.wordpress.com — unclassified
api.wordpress.org — unclassified
public-api.wordpress.com — unclassified

🔒 Full details are available with a Developer or Agency plan.

File paths, line numbers, and raw evidence are part of the paid technical detail layer.

View plans

REST API

Total routes

Public / Protected

4 / 40

Write-capable

/wc-admin/marketplace-promotions/dismiss Protected Write
/wc/v3/marketplace/featured Protected
/wc/v1/marketplace/product-preview Protected
/wc/v3/marketplace/create-order Protected Write
/wc/v3/marketplace/refresh Protected Write
/wc/v3/marketplace/subscriptions Protected
/wc/v3/marketplace/subscriptions/connect Protected Write
/wc/v3/marketplace/subscriptions/activate-plugin Protected Write
/wc/v3/marketplace/subscriptions/disconnect Protected Write
/wc/v3/marketplace/subscriptions/activate Protected Write
/wc/v3/marketplace/subscriptions/install-url Protected
/woocommerce-email-editor/v1/send_preview_email Protected Write
/woocommerce-email-editor/v1/get_personalization_tags Protected
/woocommerce-email-editor/v1/personalization_tags Protected
/wc-admin/tax/recommendations/dismiss Protected Write
/woocommerce-email-editor/v1/emails/(?P<id>\d+)/default-content Protected
/woocommerce-email-editor/v1/emails/(?P<id>\d+)/reset Protected Write
/woocommerce-email-editor/v1/emails/(?P<id>\d+)/change-summary Protected
/woocommerce-email-editor/v1/emails/(?P<id>\d+)/apply Protected Write
/woocommerce-email-editor/v1/emails/(?P<id>\d+)/undo Protected Write
/jetpack/v4/verify_xmlrpc_error Public Write
/jetpack/v4/heartbeat/data Protected
/jetpack/v4/verify_registration Public Write
/jetpack/v4/remote_authorize Public Write
/jetpack/v4/remote_provision Protected Write
/jetpack/v4/remote_register Protected Write
/jetpack/v4/remote_connect Protected Write
/jetpack/v4/connection/check Protected
/jetpack/v4/connection Public
/jetpack/v4/connection Protected Write
/jetpack/v4/connection/user Protected Write
/jetpack/v4/connection/data Protected
/jetpack/v4/connection/plugins Protected
/jetpack/v4/connection/reconnect Protected Write
/jetpack/v4/connection/register Protected Write
/jetpack/v4/connection/authorize_url Protected
/jetpack/v4/user-token Protected Write
/jetpack/v4/connection/owner Protected Write
/jetpack/v4/identity-crisis/confirm-safe-mode Protected Write
/jetpack/v4identity-crisis/migrate Protected Write
/jetpack/v4/identity-crisis/start-fresh Protected Write
/jetpack/v4/identity-crisis/idc-url-validation Protected
/jetpack/v4/identity-crisis/url-secret Protected
/jetpack/v4/identity-crisis/compare-url-secret Protected Write

🔒 Full details are available with a Developer or Agency plan.

File paths, line numbers, and raw evidence are part of the paid technical detail layer.

View plans

Activation Behaviour

Writes to the database (no)
Creates database tables (no)
Creates user accounts (no)
Creates roles (no)
Changes capabilities (no)
Creates credentials (e.g. Application Passwords) (no)
Contacts an external host (yes)
Schedules a background job (cron) (no)
Writes files (no)

Version Changes

Current version

11.1.0

Versions tracked

Latest Technical Risk

High

🔒 Full details are available with a Developer or Agency plan.

File paths, line numbers, and raw evidence are part of the paid technical detail layer.

View plans