Advisory: Phishing campaign targeting WooCommerce stores

This advisory originally appeared on WooCommerce’s Developer Documentation

We’ve identified a phishing campaign targeting WooCommerce store owners. These emails falsely claim to be from WooCommerce and alert users about critical security vulnerabilities that don’t exist.

The phishing emails:

• Come from suspicious domains like help@security-woocommerce.com, incident@notify-woocommerce.com, or help@support-woocommerce.com
• Claim a “critical security vulnerability” was found on or around April 14, 2025
• Mention a specific store URL and claim it’s directly impacted
• Ask users to download and install a “security patch” (which is actually malware)

WooCommerce security communications always come from official sources like WooCommerce.com or Automattic.com email addresses and direct users to an official download page or WordPress.org repository with clear documentation and verification steps.

1. Do not click any links or download any files
2. Do not install any plugins from these emails
3. Report the domains to your email provider as phishing

The best ways to keep your WooCommerce store secure:

• Install updates directly from your WordPress dashboard or WooCommerce.com
• Enable auto-updates for security patches
• Use strong, unique passwords and two-factor authentication
• Only install plugins from trusted sources (WordPress.org or WooCommerce.com)

We’re actively working to shut down these phishing domains. If you have concerns about your store’s security, please contact our support team through your WooCommerce.com account.

Your security is our priority.