WooCommerce security

When to use this skill

Use this skill whenever a plugin or theme extends WooCommerce:

• Reading or writing orders, products, customers, or coupons via wc_get_order(), WC_Order, WC_Product, or WC_Customer.
• Hooking checkout, cart, or order-status actions (woocommerce_checkout_*, woocommerce_order_status_*).
• Adding custom WooCommerce REST or Store API endpoints.
• Storing or displaying customer PII (names, emails, addresses, phone numbers).
• Building admin order-meta boxes or custom reports.

WooCommerce has its own capabilities and data objects. Re-using generic WordPress capabilities like edit_posts for orders often grants too much or too little access, and raw customer data is PII that must be handled carefully.