Commit 69508d1402e for woocommerce

commit 69508d1402e7c126b45933f7a3379a0df97b9abc
Author: Jorge A. Torres <jorge.torres@automattic.com>
Date:   Mon Jul 6 11:34:12 2026 +0100

    Fix deleting newly added custom fields on the HPOS order edit screen (#66132)

diff --git a/plugins/woocommerce/changelog/55864-fix-hpos-custom-fields-delete-nonce b/plugins/woocommerce/changelog/55864-fix-hpos-custom-fields-delete-nonce
new file mode 100644
index 00000000000..86edf58e792
--- /dev/null
+++ b/plugins/woocommerce/changelog/55864-fix-hpos-custom-fields-delete-nonce
@@ -0,0 +1,4 @@
+Significance: patch
+Type: fix
+
+Fix deleting a newly added custom field on the order edit screen with HPOS enabled.
diff --git a/plugins/woocommerce/src/Internal/Admin/Orders/MetaBoxes/CustomMetaBox.php b/plugins/woocommerce/src/Internal/Admin/Orders/MetaBoxes/CustomMetaBox.php
index 257b3733104..2282193ce11 100644
--- a/plugins/woocommerce/src/Internal/Admin/Orders/MetaBoxes/CustomMetaBox.php
+++ b/plugins/woocommerce/src/Internal/Admin/Orders/MetaBoxes/CustomMetaBox.php
@@ -398,7 +398,7 @@ class CustomMetaBox {
 		$r .= "\n\t\t<td class='left'><label class='screen-reader-text' for='meta-{$entry['meta_id']}-key'>" . __( 'Key', 'woocommerce' ) . "</label><input name='meta[{$entry['meta_id']}][key]' id='meta-{$entry['meta_id']}-key' type='text' size='20' value='{$entry['meta_key']}' />";

 		$r .= "\n\t\t<div class='submit'>";
-		$r .= get_submit_button( __( 'Delete', 'woocommerce' ), 'deletemeta small', "deletemeta[{$entry['meta_id']}]", false, array( 'data-wp-lists' => "delete:the-list:meta-{$entry['meta_id']}::_ajax_nonce:$delete_nonce" ) );
+		$r .= get_submit_button( __( 'Delete', 'woocommerce' ), 'deletemeta small', "deletemeta[{$entry['meta_id']}]", false, array( 'data-wp-lists' => "delete:the-list:meta-{$entry['meta_id']}::_ajax_nonce=$delete_nonce" ) );
 		$r .= "\n\t\t";
 		$r .= get_submit_button( __( 'Update', 'woocommerce' ), 'updatemeta small', "meta-{$entry['meta_id']}-submit", false, array( 'data-wp-lists' => "add:the-list:meta-{$entry['meta_id']}::_ajax_nonce-add-meta={$this->update_nonce}" ) );
 		$r .= '</div>';
diff --git a/plugins/woocommerce/tests/php/includes/class-wc-ajax-test.php b/plugins/woocommerce/tests/php/includes/class-wc-ajax-test.php
index 414bdbe8193..b866bd0b103 100644
--- a/plugins/woocommerce/tests/php/includes/class-wc-ajax-test.php
+++ b/plugins/woocommerce/tests/php/includes/class-wc-ajax-test.php
@@ -638,6 +638,31 @@ class WC_AJAX_Test extends \WP_Ajax_UnitTestCase {
 		$variation->delete( true );
 	}

+	/**
+	 * @testdox Adding a custom field renders a Delete button with a valid delete nonce.
+	 */
+	public function test_order_add_meta_delete_button_uses_name_value_nonce(): void {
+		$this->_setRole( 'administrator' );
+		$order = WC_Helper_Order::create_order();
+
+		$_POST['_ajax_nonce-add-meta'] = wp_create_nonce( 'add-meta' );
+		$_POST['order_id']             = $order->get_id();
+		$_POST['metakeyinput']         = 'my_test_key';
+		$_POST['metavalue']            = 'my_test_value';
+
+		try {
+			$this->_handleAjax( 'woocommerce_order_add_meta' );
+		} catch ( WPAjaxDieContinueException $e ) {
+			ob_end_clean();
+		}
+
+		$this->assertStringContainsString(
+			'::_ajax_nonce=',
+			(string) $this->_last_response,
+			'Delete button should use the _ajax_nonce= token.'
+		);
+	}
+
 	/**
 	 * Does the 'hard work' of triggering an ajax endpoint and capturing the response.
 	 *