Commit 3ab59f9c3b6 for woocommerce

commit 3ab59f9c3b69004b79d65bbb08ec34c208f64fc8
Author: Jorge A. Torres <jorge.torres@automattic.com>
Date:   Wed Jul 22 16:05:47 2026 +0100

    Grant site membership only after login succeeds (#66879)

diff --git a/plugins/woocommerce/changelog/fix-multisite-login-membership-order b/plugins/woocommerce/changelog/fix-multisite-login-membership-order
new file mode 100644
index 00000000000..35b9aa92845
--- /dev/null
+++ b/plugins/woocommerce/changelog/fix-multisite-login-membership-order
@@ -0,0 +1,4 @@
+Significance: patch
+Type: fix
+
+Tighten multisite site-membership handling during login.
diff --git a/plugins/woocommerce/includes/class-wc-form-handler.php b/plugins/woocommerce/includes/class-wc-form-handler.php
index cc8f3be7785..a189b36db97 100644
--- a/plugins/woocommerce/includes/class-wc-form-handler.php
+++ b/plugins/woocommerce/includes/class-wc-form-handler.php
@@ -1131,15 +1131,6 @@ class WC_Form_Handler {
 					throw new Exception( '<strong>' . __( 'Error:', 'woocommerce' ) . '</strong> ' . __( 'Username is required.', 'woocommerce' ) );
 				}

-				// On multisite, ensure user exists on current site, if not add them before allowing login.
-				if ( is_multisite() ) {
-					$user_data = get_user_by( is_email( $creds['user_login'] ) ? 'email' : 'login', $creds['user_login'] );
-
-					if ( $user_data && ! is_user_member_of_blog( $user_data->ID, get_current_blog_id() ) ) {
-						add_user_to_blog( get_current_blog_id(), $user_data->ID, 'customer' );
-					}
-				}
-
 				// Perform the login.
 				$user = wp_signon( apply_filters( 'woocommerce_login_credentials', $creds ), is_ssl() );

@@ -1147,6 +1138,11 @@ class WC_Form_Handler {
 					throw new Exception( $user->get_error_message() );
 				} else {

+					// On multisite, ensure user exists on current site, if not add them.
+					if ( is_multisite() && ! is_user_member_of_blog( $user->ID, get_current_blog_id() ) ) {
+						add_user_to_blog( get_current_blog_id(), $user->ID, 'customer' );
+					}
+
 					if ( ! empty( $_POST['redirect'] ) ) {
 						$redirect = wp_unslash( $_POST['redirect'] ); // phpcs:ignore WordPress.Security.ValidatedSanitizedInput.InputNotSanitized
 					} elseif ( wc_get_raw_referer() ) {