What’s in this release

Admin settings initialize consistently across WooCommerce admin pages. This fixes a Payments settings bug that could show a false business-location mismatch warning for stores outside the United States. (#67532)

Password protection covers product short descriptions across embeds, Product Summary blocks, and block-based single-product templates. Shoppers must enter the product password before these summaries appear. (#67557)

Store API payments for existing orders enforce each coupon usage limits correctly. (#67549)

Store API cart tokens are read from one request source and validated before a customer session loads. A PHP_CodeSniffer rule catches direct token reads in future Store API code. (#67550)

Guest session cookies now use a stronger, salted hashing scheme. Legacy cookies remain valid until they expire so guest carts survive the upgrade. (#67408)

Single dismissible notices in Cart and Checkout blocks are sanitized before rendering. Entity-encoded HTML in Store API error messages is displayed as safe content instead of executable markup. (#67476)

The [woocommerce_review_order] shortcode renders only on WooCommerce’s managed review-order page with a matching order key. Requests from other pages or with the wrong key return no order content. (#67552)

External product button labels pass through text sanitization when submitted to REST API versions 1 through 4, and the Product Button block escapes labels on output. (#67558)

Automatic featured-image matching by SKU requires the current user to have the edit_product capability for the matched product. An image upload cannot change a product the user lacks permission to edit. (#67530)

Activating a Marketplace subscription requires activate_plugins for plugins or switch_themes for themes. The endpoint also rejects unsupported product types. (#67567)

The onboarding theme-installation endpoint checks the WordPress install_themes capability. Users without that permission cannot install a theme through onboarding. (#67533)

Analytics CSV exports validate report_args against the selected report’s REST schema. Unsupported orderby values are rejected whether an export is queued through REST or directly in PHP. (#67551)

Analytics order reports accept only recognized date columns from the woocommerce_date_type option or a date_type query argument. Unknown stored values fall back to date_paid, while unknown per-request values fall back to date_created. (#67554)

Writing a log no longer requires scanning the entire wc-logs directory, reducing checkout latency on stores with large log backlogs. Cleanup processes bounded batches until the backlog is empty, and the woocommerce_order_step_logging_enabled filter lets developers disable place-order debug logging without changing the site-wide threshold. (#67410)

The Orders list is compatible with WordPress 7.1’s updated list-table markup. Checkbox interactions and responsive layouts work correctly with both the old and new primary-cell markup. (#67364)

The product-review list-table test accepts both the older check-column markup and the markup introduced in WordPress 7.1. This keeps pre-release CI compatible with both versions without changing runtime behavior. (#67517)

The Add Product screen’s JavaScript-count test accounts for the wp-tooltip and wp-sync scripts added in WordPress 7.1. This test-only change does not affect runtime behavior. (#67473)