Commit 3ab59f9c3b6 for woocommerce
commit 3ab59f9c3b69004b79d65bbb08ec34c208f64fc8
Author: Jorge A. Torres <jorge.torres@automattic.com>
Date: Wed Jul 22 16:05:47 2026 +0100
Grant site membership only after login succeeds (#66879)
diff --git a/plugins/woocommerce/changelog/fix-multisite-login-membership-order b/plugins/woocommerce/changelog/fix-multisite-login-membership-order
new file mode 100644
index 00000000000..35b9aa92845
--- /dev/null
+++ b/plugins/woocommerce/changelog/fix-multisite-login-membership-order
@@ -0,0 +1,4 @@
+Significance: patch
+Type: fix
+
+Tighten multisite site-membership handling during login.
diff --git a/plugins/woocommerce/includes/class-wc-form-handler.php b/plugins/woocommerce/includes/class-wc-form-handler.php
index cc8f3be7785..a189b36db97 100644
--- a/plugins/woocommerce/includes/class-wc-form-handler.php
+++ b/plugins/woocommerce/includes/class-wc-form-handler.php
@@ -1131,15 +1131,6 @@ class WC_Form_Handler {
throw new Exception( '<strong>' . __( 'Error:', 'woocommerce' ) . '</strong> ' . __( 'Username is required.', 'woocommerce' ) );
}
- // On multisite, ensure user exists on current site, if not add them before allowing login.
- if ( is_multisite() ) {
- $user_data = get_user_by( is_email( $creds['user_login'] ) ? 'email' : 'login', $creds['user_login'] );
-
- if ( $user_data && ! is_user_member_of_blog( $user_data->ID, get_current_blog_id() ) ) {
- add_user_to_blog( get_current_blog_id(), $user_data->ID, 'customer' );
- }
- }
-
// Perform the login.
$user = wp_signon( apply_filters( 'woocommerce_login_credentials', $creds ), is_ssl() );
@@ -1147,6 +1138,11 @@ class WC_Form_Handler {
throw new Exception( $user->get_error_message() );
} else {
+ // On multisite, ensure user exists on current site, if not add them.
+ if ( is_multisite() && ! is_user_member_of_blog( $user->ID, get_current_blog_id() ) ) {
+ add_user_to_blog( get_current_blog_id(), $user->ID, 'customer' );
+ }
+
if ( ! empty( $_POST['redirect'] ) ) {
$redirect = wp_unslash( $_POST['redirect'] ); // phpcs:ignore WordPress.Security.ValidatedSanitizedInput.InputNotSanitized
} elseif ( wc_get_raw_referer() ) {