Commit 2b5e20e6cea for woocommerce

commit 2b5e20e6cea7a842ee5e1649798b640f5083455f
Author: Vlad Olaru <vlad.olaru@automattic.com>
Date:   Tue Sep 1 17:52:38 2026 +0300

    Fix WooPayments onboarding profile data handling (#68232)

    * fix: Harden WooPayments profile data handling

    WooPayments expects its stored onboarding profile to be an array, but
    the loading path did not enforce that shape consistently.

    Validate the retrieved value before use and treat unexpected values as an
    empty profile. Add regression coverage for invalid stored data.

    Refs WOO6-82

    * chore: Add changelog entry for WooPayments profile handling

    Record the patch-level change in the WooCommerce changelog using a
    generic description appropriate for public release notes.

    Refs WOO6-82

diff --git a/plugins/woocommerce/changelog/fix-woopayments-profile-data-handling b/plugins/woocommerce/changelog/fix-woopayments-profile-data-handling
new file mode 100644
index 00000000000..2a7f3264c9a
--- /dev/null
+++ b/plugins/woocommerce/changelog/fix-woopayments-profile-data-handling
@@ -0,0 +1,4 @@
+Significance: patch
+Type: fix
+
+Improve WooPayments onboarding profile data handling.
diff --git a/plugins/woocommerce/src/Internal/Admin/Settings/PaymentsProviders/WooPayments/WooPaymentsService.php b/plugins/woocommerce/src/Internal/Admin/Settings/PaymentsProviders/WooPayments/WooPaymentsService.php
index 0b287154e1a..9fe21c9e713 100644
--- a/plugins/woocommerce/src/Internal/Admin/Settings/PaymentsProviders/WooPayments/WooPaymentsService.php
+++ b/plugins/woocommerce/src/Internal/Admin/Settings/PaymentsProviders/WooPayments/WooPaymentsService.php
@@ -2493,10 +2493,8 @@ class WooPaymentsService {
 	private function get_nox_profile(): array {
 		$nox_profile = $this->proxy->call_function( 'get_option', self::NOX_PROFILE_OPTION_KEY, array() );

-		if ( empty( $nox_profile ) ) {
-			$nox_profile = array();
-		} else {
-			$nox_profile = maybe_unserialize( $nox_profile );
+		if ( ! is_array( $nox_profile ) ) {
+			return array();
 		}

 		return $nox_profile;
diff --git a/plugins/woocommerce/tests/php/src/Internal/Admin/Settings/PaymentsProviders/WooPayments/NoxProfileObjectInstantiationProbe.php b/plugins/woocommerce/tests/php/src/Internal/Admin/Settings/PaymentsProviders/WooPayments/NoxProfileObjectInstantiationProbe.php
new file mode 100644
index 00000000000..7eddd4aaceb
--- /dev/null
+++ b/plugins/woocommerce/tests/php/src/Internal/Admin/Settings/PaymentsProviders/WooPayments/NoxProfileObjectInstantiationProbe.php
@@ -0,0 +1,24 @@
+<?php
+declare( strict_types=1 );
+
+namespace Automattic\WooCommerce\Tests\Internal\Admin\Settings\PaymentsProviders\WooPayments;
+
+/**
+ * Probe for detecting NOX profile object instantiation.
+ */
+final class NoxProfileObjectInstantiationProbe {
+
+	/**
+	 * Whether the probe was instantiated from a serialized value.
+	 *
+	 * @var bool
+	 */
+	public static bool $was_unserialized = false;
+
+	/**
+	 * Record object instantiation from a serialized value.
+	 */
+	public function __wakeup(): void {
+		self::$was_unserialized = true;
+	}
+}
diff --git a/plugins/woocommerce/tests/php/src/Internal/Admin/Settings/PaymentsProviders/WooPayments/WooPaymentsServiceTest.php b/plugins/woocommerce/tests/php/src/Internal/Admin/Settings/PaymentsProviders/WooPayments/WooPaymentsServiceTest.php
index e9b0e8cf067..aa173124af1 100644
--- a/plugins/woocommerce/tests/php/src/Internal/Admin/Settings/PaymentsProviders/WooPayments/WooPaymentsServiceTest.php
+++ b/plugins/woocommerce/tests/php/src/Internal/Admin/Settings/PaymentsProviders/WooPayments/WooPaymentsServiceTest.php
@@ -2455,6 +2455,36 @@ class WooPaymentsServiceTest extends WC_Unit_Test_Case {
 		$this->assertSame( $expected_status, $result );
 	}

+	/**
+	 * @testdox Serialized NOX profile strings are ignored without instantiating objects.
+	 */
+	public function test_get_onboarding_step_status_ignores_serialized_profile_string(): void {
+		NoxProfileObjectInstantiationProbe::$was_unserialized = false;
+
+		$serialized_profile = maybe_serialize(
+			array(
+				'probe' => new NoxProfileObjectInstantiationProbe(),
+			)
+		);
+
+		$this->mockable_proxy->register_function_mocks(
+			array(
+				'get_option' => function ( $option_name, $default_value = null ) use ( $serialized_profile ) {
+					if ( WooPaymentsService::NOX_PROFILE_OPTION_KEY === $option_name ) {
+						return $serialized_profile;
+					}
+
+					return $default_value;
+				},
+			)
+		);
+
+		$status = $this->sut->get_onboarding_step_status( WooPaymentsService::ONBOARDING_STEP_PAYMENT_METHODS, 'US' );
+
+		$this->assertSame( WooPaymentsService::ONBOARDING_STEP_STATUS_NOT_STARTED, $status );
+		$this->assertFalse( NoxProfileObjectInstantiationProbe::$was_unserialized, 'Serialized NOX profile strings must not instantiate objects.' );
+	}
+
 	/**
 	 * Data provider for test_get_onboarding_step_status.
 	 *