Commit 121af95ad28 for woocommerce
commit 121af95ad2811d08ae9e63741d2f98522e3fe26c
Author: Darren Ethier <darren@roughsmootheng.in>
Date: Fri Oct 23 14:08:08 2026 -0400
Warn PHP < 8.1 stores about the October 2026 PHP security vulnerabilities (#70158)
Extend the PHP 8.1 requirement notice with a paragraph explaining that
official PHP releases below 8.1 do not include the fixes for
CVE-2026-109618 and CVE-2026-109619, and asking merchants to confirm
with their host whether their server is patched. Also ask merchants to
upgrade to the latest PHP 8.3 release, keeping PHP 8.1 as the stated
minimum, since earlier 8.3 releases are affected too.
Move the "Learn more" link to its own right-aligned line below both
paragraphs, open it in a new tab with the standard external link icon,
add UTM parameters so clicks from the notice can be measured on
developer.woocommerce.com, and use text-wrap: pretty to avoid
single-word last lines where browsers support it.
diff --git a/plugins/woocommerce/changelog/add-php-insecure-version-notice b/plugins/woocommerce/changelog/add-php-insecure-version-notice
new file mode 100644
index 00000000000..21ef89f0026
--- /dev/null
+++ b/plugins/woocommerce/changelog/add-php-insecure-version-notice
@@ -0,0 +1,4 @@
+Significance: patch
+Type: update
+
+Warn stores on PHP older than 8.1 that their PHP version may be affected by critical security vulnerabilities, and recommend the latest PHP 8.3 release.
diff --git a/plugins/woocommerce/client/legacy/css/activation.scss b/plugins/woocommerce/client/legacy/css/activation.scss
index 21a71594403..8d4e366f259 100644
--- a/plugins/woocommerce/client/legacy/css/activation.scss
+++ b/plugins/woocommerce/client/legacy/css/activation.scss
@@ -62,3 +62,18 @@ p.woocommerce-actions,
top: 18px;
}
}
+
+// PHP version requirement notice. Avoid single-word last lines where supported.
+.woocommerce-message .wc-php-version-notice {
+ text-wrap: pretty;
+
+ .wc-php-version-notice__learn-more {
+ text-align: end;
+
+ // Core aligns the 20px icon to the top of the line, which sits high next to 13px text.
+ .dashicons-external {
+ margin-top: 0;
+ vertical-align: middle;
+ }
+ }
+}
diff --git a/plugins/woocommerce/includes/admin/class-wc-admin-notices.php b/plugins/woocommerce/includes/admin/class-wc-admin-notices.php
index 4d767b445f6..406bc6e14a8 100644
--- a/plugins/woocommerce/includes/admin/class-wc-admin-notices.php
+++ b/plugins/woocommerce/includes/admin/class-wc-admin-notices.php
@@ -175,18 +175,40 @@ class WC_Admin_Notices {
self::add_custom_notice(
'php81_required_in_woo_116',
sprintf(
- '<h4>%s</h4>%s',
+ '<div class="wc-php-version-notice"><h4>%s</h4>%s%s<p class="wc-php-version-notice__learn-more"><b><a href="%s" target="_blank" rel="noopener noreferrer">%s<span class="screen-reader-text"> %s</span><span aria-hidden="true" class="dashicons dashicons-external"></span></a></b></p></div>',
esc_html__( 'PHP version requirements will change soon', 'woocommerce' ),
wpautop(
wp_kses_data(
sprintf(
- /* translators: 1: The PHP version the server is currently running. 2: URL of the announcement post. */
- __( 'WooCommerce 11.6, planned for release in <b>February 2027</b>, will require PHP 8.1 or newer to work. Your server is currently running PHP %1$s, so this change will impact your store. Please contact your hosting provider to upgrade to PHP 8.1 or newer (at least PHP 8.3 is recommended). <b><a href="%2$s">Learn more about this change.</a></b>', 'woocommerce' ),
- phpversion(),
- esc_url( 'https://developer.woocommerce.com/2026/09/29/php-8-1-requirement/' )
+ /* translators: %s: The PHP version the server is currently running. */
+ __( 'WooCommerce 11.6, planned for release in <b>February 2027</b>, will require PHP 8.1 or newer to work. Your server is currently running PHP %s, so this change will impact your store. Please contact your hosting provider to upgrade to the latest PHP 8.3 release or newer (PHP 8.1 is the minimum WooCommerce will require).', 'woocommerce' ),
+ phpversion()
)
)
- )
+ ),
+ // CVE-2026-109618 and CVE-2026-109619 affect every PHP release below 8.2.35, and PHP has no fixed release below 8.2, so every version this notice targets is affected.
+ wpautop(
+ wp_kses_data(
+ sprintf(
+ /* translators: %s: The PHP version the server is currently running. */
+ __( '<b>Your PHP version may also be affected by critical security vulnerabilities.</b> Official PHP %s releases do not include the fixes for CVE-2026-109618 and CVE-2026-109619 (disclosed in October 2026), which can let attackers run code on your server. Some hosting providers apply these fixes themselves, so when you contact yours about upgrading, ask them to confirm your server is patched.', 'woocommerce' ),
+ phpversion()
+ )
+ )
+ ),
+ esc_url(
+ add_query_arg(
+ array(
+ 'utm_source' => 'admin_notice',
+ 'utm_medium' => 'product',
+ 'utm_campaign' => 'php81_requirement',
+ 'utm_content' => 'learn_more',
+ ),
+ 'https://developer.woocommerce.com/2026/09/29/php-8-1-requirement/'
+ )
+ ),
+ esc_html__( 'Learn more about this change', 'woocommerce' ),
+ esc_html__( '(opens in a new tab)', 'woocommerce' )
)
);
}