Penetration Testing for WooCommerce UK — The Security Risks Specific to WordPress E-commerce

WooCommerce Is the UK’s Most Common E-commerce Attack Surface

WooCommerce powers roughly 40% of all online stores globally. In the UK, thousands of small and medium retailers use it to sell everything from handmade goods to industrial components. That popularity makes it an extremely well-understood attack target.

Attackers do not need to invent new techniques for WooCommerce. The vulnerabilities are documented, the exploitation scripts are publicly available, and the stores are trivial to discover. This guide explains what attackers look for in WooCommerce installations and how to test your own store before they do.

Why WooCommerce Presents Unique Security Challenges

A standard web application has one codebase. WooCommerce is a plugin for WordPress, which itself runs on PHP, which is typically deployed on a shared hosting environment. On top of that, most WooCommerce stores run additional plugins — payment gateways, shipping calculators, review systems, inventory managers, loyalty programmes.

Every plugin is another attack surface. Each one is written by a different developer, updated on a different schedule, and may interact with WooCommerce’s database in ways that create vulnerabilities the original developers did not anticipate.

The UK’s Information Commissioner’s Office has seen numerous data breach notifications involving small e-commerce sites. The breach pattern is almost always the same: a vulnerable plugin, unpatched for months, exploited to access customer data.

Vulnerabilities Specific to WooCommerce Stores

Unauthenticated Order Access via IDOR

WooCommerce generates order confirmation pages at URLs like `/my-account/orders/12345/`. If the order ID is sequential and the permission check is missing or bypassed, an attacker can enumerate order IDs and access other customers’ order details — names, addresses, purchase history.

This type of insecure direct object reference (IDOR) vulnerability has been found in WooCommerce itself and in multiple order management plugins. A penetration test checks whether incrementing the order ID in the URL returns another customer’s data.

SQL Injection via Plugin Search and Filter Functions

Product search, price filter, and attribute filter plugins often construct SQL queries using user-supplied input. When that input is not properly sanitised with prepared statements, SQL injection becomes possible.

CVE-2022-0739, affecting the “Product Filter by WooBeWoo” plugin with over 10,000 active installs, was an unauthenticated SQL injection vulnerability — any visitor to the site could extract the entire database without logging in.

A penetration test sends SQL metacharacters and boolean conditions through every search and filter endpoint to detect this class of vulnerability.

Privilege Escalation via Registration Endpoints

WooCommerce allows customers to register accounts. Certain plugins add additional registration fields or modify the registration flow. Vulnerabilities in this flow can allow an attacker to register as a customer but escalate their role to administrator.

This class of vulnerability has appeared in WooCommerce extensions from reputable vendors. The consequence is complete site compromise — the attacker has full WordPress admin access.

Payment Skimming via Malicious Code Injection

If an attacker gains access to your WordPress installation through any vulnerability — a weak admin password, a vulnerable plugin, a compromised FTP account — they can inject JavaScript that captures payment card details at the checkout page and exfiltrates them to an attacker-controlled server.

This is called a web skimmer or Magecart attack (named after a notorious threat group). The injected script is invisible to the customer. Their card details are silently copied before being passed to your legitimate payment processor.

Detection requires server-side file integrity monitoring and client-side content security policy headers that would block unauthorised scripts. A penetration test checks for existing injections and for the configuration weaknesses that enable them.

WooCommerce REST API Exposure

WooCommerce exposes a REST API that allows programmatic access to orders, customers, and products. If API authentication is misconfigured — consumer keys with excessive permissions, or endpoints accessible without authentication — an attacker can enumerate your entire customer database via the API.

Check `/wp-json/wc/v3/customers` on your store. If it returns customer data without authentication, you have a serious exposure.

WordPress Admin Panel Exposed to the Internet

`/wp-admin/` should be accessible only from trusted IP addresses, or protected by an additional authentication layer. An exposed WordPress admin with a weak or reused password is trivially brute-forced.

Wordfence’s 2025 threat report documented millions of brute force attempts against WordPress login pages daily. Most WooCommerce stores have `/wp-admin/` fully exposed with no rate limiting.

What a WooCommerce Penetration Test Covers

A targeted assessment of a WooCommerce store typically includes:

- WordPress core version and plugin version audit against CVE databases - Authentication testing: brute force protection on `/wp-login.php`, REST API authentication - IDOR testing across order, account, and product endpoints - SQL injection testing via search, filter, and cart parameter manipulation - Security header analysis (CSP, X-Frame-Options, HSTS) - File inclusion and directory traversal checks - Payment page analysis for existing skimmer injections - WooCommerce REST API permission audit

Yrzo AI’s automated scanner covers the web application vulnerability classes above — SQL injection, IDOR, security headers, authentication issues — and returns findings within 20 minutes.

The Compliance Dimension

If you handle customer payment cards, you are in scope for PCI DSS regardless of whether you use a hosted payment page or a full integration. Specifically:

- **PCI DSS Requirement 6.3.2** requires an inventory of all bespoke software (including plugins) and review of their security - **PCI DSS Requirement 11.3** requires penetration testing of your cardholder data environment at least annually - **PCI DSS Requirement 11.4** requires a web application firewall or review process for public-facing web applications

A WooCommerce store using Stripe or PayPal’s hosted checkout reduces your PCI scope significantly — the card data never touches your server. But you are still responsible for your application’s security, and a skimmer attack bypasses the hosted checkout entirely by capturing card details at the browser before submission.

Immediate Actions for WooCommerce Store Owners

1. **Update everything.** WordPress core, WooCommerce, all plugins. Do this now, not next week. 2. **Audit your plugins.** Every installed plugin is attack surface. Remove anything you are not actively using. 3. **Restrict `/wp-admin/`.** IP whitelist or an additional login layer via your hosting panel. 4. **Enable MFA on your WordPress admin account.** The free “Two Factor” plugin or Google Authenticator plugin handles this. 5. **Check your Content Security Policy header.** A strict CSP makes skimmer injection dramatically harder. 6. **Run a security scan.** An automated scan will surface the vulnerability classes above within minutes.

Your customers’ data and your business reputation depend on getting this right.