100,000+ Stores Run This WooCommerce Plugin  🔗 **Source:** [100,000+ Stores Run This WooCommerce Plugin](https://twitter.com/SybreWaaijer/status/2045660722168758336/?rw_tt_thread=True) > [!note]+ Document Notes > ```markdown > > --- > tags: [WordPress, WooCommerce, Subscriptions] > author: Sybre Waaijer > source: Twitter > reference: [https://twitter.com/SybreWaaijer/status/2045660722168758336/?rw_tt_thread=True] > date created: > > --- > > # 🏷️ Title: 100,000+ stores run this WooCommerce plugin > <!-- deep-read:sections start --> ## 🧭 Table of Contents - [📝 Summary](#-summary) - [📖 Main Content](#-main-content) - [🗒️ Notes](#️-notes) - [📚 References](#-references) - [🗣️ Paraphrase](#️-paraphrase) - [📰 Newsletter](#-newsletter) - [✅ Action Items](#-action-items) - [🧪 Hypotheses](#-hypotheses) - [📊 Methodology](#-methodology) - [❓ Questions](#-questions) - [🔮 Future Research](#-future-research) - [💡 Implications](#-implications) - [🧠 Learning Styles Assessment](#-learning-styles-assessment) - [📊 Accessibility Assessment](#-accessibility-assessment) - [🌍 DEIB Assessment](#-deib-assessment) - [✅ Logical Validity](#-logical-validity) - [🛡️ DARVO Analysis](#-darvo-analysis) - [🎯 Conclusion](#-conclusion) ### 🔗 References - Include links cited in or relevant to the article. --- ## 📝 Summary - What happened: A WooCommerce Subscriptions bug (actually multiple bugs) silently set some subscriptions to manual payments, so renewals never auto-charged after checkout or product switches. - Why it matters: Stores could lose ~7% of subscription revenue for years without any clear error signal, potentially hundreds of thousands per site. - Key stakeholders: WooCommerce core & Subscriptions teams, payment gateway developers, WordPress/WooCommerce merchants, auditors/consultants. - Risks and tradeoffs: Lost MRR, hidden churn, inaccurate metrics, possible customer confusion or involuntary “downgrades” to manual payment. - Bottom line: Any store running WooCommerce Subscriptions—especially older installs—should audit subscription payment types and ensure they’re on fixed plugin versions. --- ## 📖 Main Content - The thread explains that WooCommerce Subscriptions uses an internal flag to decide if a subscription should auto-charge via gateways like Stripe/PayPal or wait for manual payment. - If this flag is incorrectly left on “manual,” renewals: - Are never attempted automatically. - Do not send failure emails. - Move to “on hold” and rely on customers noticing and paying manually. - The author originally reported a bug related to product switches breaking subscription payments, then performed a broader audit on a real store’s data from 2017–2024. - They found three bugs: - **Bug 1 – Stale cache**: After saving subscription dates, the order cache was not cleared, so later saves could reuse an object where the flag was still the default (manual). Fixed in `subscriptions-core 6.9.0`. - **Bug 2 – Broken HPOS backfill**: Missing getters/setters prevented subscription metadata syncing correctly when HPOS data sync was on, causing bad or missing payment-related state. Fixed in `subscriptions-core 6.5.0`. - **Bug 3 – Unnecessary re-fetch**: `wcs_create_subscription()` re-fetched the subscription from cache/DB instead of using the configured instance, discarding unsaved state, including the corrected payment flag. Fixed in `subscriptions-core 7.1.0`. - Combined, these issues caused about **7%** of checkout-created subscriptions to start life with broken automatic payments while the initial checkout still succeeded. - Over seven years, one audited store had **121 affected subscriptions** and **$43,274** in lost revenue; extrapolated to 100k+ installs and larger ARR, this could mean very large aggregate losses. - The author urges WooCommerce store owners and consultants to: - Verify plugin versions. - Audit subscriptions for incorrect payment types. - Add monitoring/alerts for unexpected manual renewals and “on hold” states. --- ### 🗒️ Notes - WooCommerce Subscriptions relies on an *internal payment type flag* (“automatic” vs “manual”) that is easy to silently mis-set via bugs in how subscriptions are created or updated. - When a customer checks out with Stripe or PayPal, the expected behavior is that their subscription will continue to be charged automatically without further action. - If that flag is left on manual: - The system never calls the payment gateway for renewals. - No renewals fail in the usual way, so normal failure notifications are not triggered. - The subscription just goes on hold, creating “invisible churn.” - The author initially reported a product-switch bug that broke renewals, then broadened their analysis when they realized the underlying handling of subscription objects might be flawed. - The three bugs have different root causes (caching, HPOS metadata synchronization, and object lifecycle), but all converge on losing the correct state for the auto-payment flag. - Fix versions matter: - Sites pinned to older `subscriptions-core` versions remain exposed. - Even upgraded sites may have *legacy broken subscriptions* that will never self-heal without active correction. - The real-store case study quantifies impact: tens of thousands in lost revenue from just 121 subscriptions across several years. - There is an implied need for: - Better end-to-end tests around subscription creation paths. - Stronger observability (e.g., dashboards for “on hold” vs “active” subscriptions, and manual vs automatic payment mix). - Safer caching and object APIs inside Subscriptions’ core. --- ## 📚 References - [Sybre Waaijer – 100,000+ stores run this WooCommerce plugin (Twitter thread)](https://twitter.com/SybreWaaijer/status/2045660722168758336/?rw_tt_thread=True) - [WooCommerce Subscriptions documentation](https://woocommerce.com/products/woocommerce-subscriptions/) - [WooCommerce High Performance Order Storage (HPOS) overview](https://woocommerce.com/document/high-performance-order-storage/) --- ## 🗣️ Paraphrase - The WooCommerce Subscriptions plugin had several long-standing bugs that caused some subscriptions created at checkout to be incorrectly set to manual payments, silently disabling automatic renewals and costing stores substantial recurring revenue. - By auditing a single store’s historical data, the author found over a hundred affected subscriptions and more than forty thousand dollars in lost income, then traced the problem to three specific bugs that have been fixed in recent plugin versions but may still affect legacy data. --- ## 📰 Newsletter In today’s WordPress corner, a vital heads-up for WooCommerce merchants and agencies: Sybre Waaijer uncovered multiple bugs in WooCommerce Subscriptions that silently disabled automatic renewals for a slice of customers. One real store lost over $43k in MRR because subscriptions quietly flipped to manual payments. If you manage WooCommerce Subscriptions, now’s the time to: - Confirm you’re running up-to-date `subscriptions-core` (≥7.1.0). - Audit subscriptions where customers checked out with Stripe/PayPal but the payment type isn’t automatic. - Review your monitoring: track “on-hold” subscriptions and unexpected manual renewals. Useful starting points: - WooCommerce Subscriptions: https://woocommerce.com/products/woocommerce-subscriptions/ - HPOS overview: https://woocommerce.com/document/high-performance-order-storage/ Stay safe, keep those renewals flowing, and consider building a small health-check report for your clients’ stores. --- ## ✅ Action Items #### DevRel - Document the subscription payment-type flag behavior in developer docs, including known historical bugs and fixed versions. - Prepare a demo or blog post showing how to audit and repair affected subscriptions programmatically. - Add example code for defensive checks around `wcs_create_subscription()` and caching with HPOS. #### OSPO - Encourage plugin teams to adopt stricter regression testing for payment and billing logic. - Integrate subscription and payment-path checks into standard open source review and QA guidelines. #### Community - Share an auditing checklist for WooCommerce merchants in forums, Slack, and meetups. - Encourage agencies to run one-time audits on legacy stores and communicate findings transparently to clients. #### WordPress - Core: No direct change, but highlight the need for robust plugin QA around financial flows. - Core Performance: Consider guidance on safe caching strategies that don’t compromise data integrity for eCommerce. - Core AI: Potential future use of anomaly detection for missed renewals or suspicious “on hold” patterns. - **Core Program Team:** Coordinate with WooCommerce teams on best-practice patterns for mission-critical plugins. - Mobile: Ensure mobile dashboards can surface subscription health metrics (e.g., on-hold counts). - Playground: Provide reproducible environments for testing Subscriptions + HPOS interactions. - Community: Promote talks on “auditing your WooCommerce subscriptions” at WordCamps. - Training: Create lessons on eCommerce reliability and subscription lifecycle management. - Marketing: Run educational campaigns around “Don’t lose subscription revenue silently.” - Support: Add KB articles about auditing broken automatic payments in WooCommerce Subscriptions. - Design: Recommend admin UX that surfaces manual-vs-automatic subscription ratios clearly. - Documentation: Improve docs around subscription states, HPOS sync, and cache invalidation. - Photos / TV / Polyglots / Accessibility / Meta / CLI / Hosting / Tide / Openverse / Themes / Plugins: - Where relevant, ensure docs and tools highlight payment-critical testing and error visibility for WooCommerce-based solutions. #### The WPOCC - Programs: Support maintainers and auditors working on tooling to detect subscription revenue leaks. - Projects: Coordinate documentation sprints focused on WooCommerce reliability patterns. - Funding experiments: Consider microgrants for plugins that monitor and report on subscription anomalies. ### FAIR - Technical independence: Encourage local tools that verify payment flows and subscription states. - Policies and covenants: Advocate for transparent disclosure when serious revenue-impacting bugs are fixed. - Productized governance artifacts: Provide templates for incident reports and remediation plans around financial bugs. --- ## 🧪 Hypotheses - H1: A measurable share (~5–10%) of subscriptions created during the affected versions were incorrectly set to manual payments. - H2: Stores with higher subscription volume and longer runtime on old versions have disproportionately higher hidden revenue loss. - H3: Clear admin warnings and dashboards about manual-vs-automatic subscriptions reduce future revenue leakage. - H4: Automated audits and repair tools will reclaim significant recurring revenue with minimal customer friction. --- ### 📊 Methodology - Use database queries on large WooCommerce stores to: - Identify subscriptions created between specific plugin versions. - Filter where checkout used an automatic-capable gateway (e.g., Stripe, PayPal) but payment type is manual. - Compare expected vs actual renewal revenue over time for those subscriptions. - A/B test new admin notices or dashboards to see if they increase detection and correction. --- ### ❓ Questions - How many stores remain on vulnerable `subscriptions-core` versions? - Are there other subscription lifecycle paths (upgrades, downgrades, switches) that still mishandle the payment-type flag? - What is the best UX to warn store owners about unexpectedly manual subscriptions without overwhelming them? --- ### 🔮 Future Research - Build a standardized audit report plugin for WooCommerce that flags suspicious subscription configurations. - Explore anomaly detection (e.g., sudden spikes in on-hold or manual subscriptions) using telemetry. - Investigate how other eCommerce platforms guard against similar silent billing failures. --- ### 💡 Implications - **Practice:** Agencies should add subscription audits to their standard WooCommerce maintenance offerings. - **Policy:** Large merchants may need stricter internal change-management and testing policies for billing-related plugins. - **Security:** While not a security bug, silent revenue loss is a critical reliability risk akin to financial data corruption. - **Education:** Training for WordPress developers should emphasize the fragility of payment flows and stateful billing logic. - **Funding models:** Demonstrates the value of funding deep technical audits for widely deployed commercial plugins. --- ### 🧠 Learning Styles Assessment - Estimated reading level: About 9th–10th grade (Flesch–Kincaid style) given technical terms like “metadata,” “backfill,” and “HPOS.” #### 👀 Visual learners - Present: Conceptual contrast between “automatic” vs “manual” payment states. - Improve: Add diagrams of the subscription lifecycle and data flow, plus before/after charts of revenue impact. #### 🔊 Aural learners - Present: None inherent (text tweet/thread). - Improve: Short audio or podcast-style explanation of the bug and how to audit for it. #### 🗣️ Verbal learners - Present: Clear description of each bug and the impact, with some terminology defined implicitly. - Improve: Add explicit glossary for terms like HPOS, backfill, and cache invalidation. #### 🧩 Kinesthetic learners - Present: Implied actions (audit, upgrade, fix), but no step-by-step. - Improve: Provide a concrete checklist and CLI/SQL steps to detect and repair affected subscriptions. #### 🧠 Logical learners - Present: Cause-effect chains (bug → wrong flag → no renewals → revenue loss). - Improve: Include tables summarizing bug versions, symptoms, and fixes. #### 🧑‍🤝‍🧑 Social learners - Present: Community call-to-action to check stores. - Improve: Guided group exercises at meetups or workshops to run audits together. #### 🧘‍♀️ Solitary learners - Present: Self-contained explanation that can be read and reflected on alone. - Improve: Add self-check prompts like “How would I detect this on my own sites?” #### 🌿 Naturalistic learners - Present: No environment analogies. - Improve: Use ecosystem metaphors (e.g., “silent disease” in a forest) to illustrate systemic risk. --- ### 📊 Accessibility Assessment #### Screen reader semantics - Present: Threaded text with basic structure. - Improve: Provide a well-structured article version with headings and clear landmark roles. #### Keyboard navigation - Present: Default Twitter behavior. - Improve: A plain HTML summary page with clear skip links and logical tab order. #### Contrast and readability - Present: Twitter’s default theming passes typical contrast requirements. - Improve: Offer a high-contrast documentation page with adjustable font sizes and line-height. #### Text resizing and reflow - Present: Twitter is responsive but not fully optimized for all zoom levels. - Improve: A dedicated doc page that maintains layout fidelity at ≥200% zoom. #### Media and captions - Present: Primarily text. - Improve: If any demos are added later (screenshots/videos), ensure captions and transcripts. #### Forms and interactions - Present: None specific in the content. - Improve: Any future audit tools should use accessible forms with clear error messages. #### Standards reference - Align any new docs or tools with WCAG 2.2 AA, especially for color contrast, focus indicators, and keyboard operability. --- ### 🌍 DEIB Assessment #### Cultural breadth - Present: Content is payment-tech specific, not culture-specific. - Improve: Include examples from a variety of global WooCommerce use cases (subscriptions in different regions/sectors). #### Inclusive language - Present: Neutral, technical language. - Improve: Provide more plain-language summaries for non-technical store owners. #### Neurodiversity support - Present: Reasonably chunked explanations (bugs listed separately). - Improve: Use bullet lists, consistent heading structure, and avoid long dense paragraphs in any expanded article form. #### Representation - Present: Focused on software, not people. - Improve: When adding illustrations or examples, ensure diverse representation. #### Psychological safety - Present: Direct but not blaming tone; focuses on fixes. - Improve: Emphasize that running audits is normal and not a sign of incompetence. --- ### ✅ Logical Validity #### Strong reasoning - The author uses causal reasoning: incorrect payment-type flag → no automatic renewals → lost revenue. This is sound given how Subscriptions works. - The argument is supported by concrete data (121 affected subscriptions, $43,274 lost), strengthening inductive claims about broader risk. #### Fallacies - Possible overgeneralization when extrapolating from one store to “any store with $1M ARR could be missing $700k+.” The direction of concern is valid, but the ratio may be extreme without more data. A clearer confidence range or caveats would improve it. #### Tone of voice - Tone is urgent, technical, and somewhat alarmed, designed to spur audits and upgrades, while remaining focused on facts and fixes. --- ### 🛡️ DARVO Analysis - Deny: No denial or minimization; the thread foregrounds the seriousness of the issue. - Attack: No attacks on individuals; criticism is implicitly directed at missed QA and design choices. - Reverse victim/offender: The author doesn’t frame WooCommerce as a victim; instead, they highlight stores and customers as those harmed by the bugs. --- ## 🎯 Conclusion The thread exposes multiple long-running bugs in WooCommerce Subscriptions that silently disable automatic renewals, leading to significant hidden revenue loss. Store owners and agencies should urgently verify plugin versions, audit subscriptions for incorrect payment types, correct broken records, and improve monitoring so that this class of failure can’t remain invisible in the future. --- ## 🧱 Refactor Appendix (append after 🎯 Conclusion) ### 📚 Literature Split Pad - Purpose: Stage Konik CEE units that become per-source Literature notes. - Split level: **H3**. - Include verbatim quotes under 25 words and a [view highlight] link. ### [H1] WooCommerce Subscriptions bug breaks auto-renewals > [!quote] [100,000+ stores run this WooCommerce plugin](https://twitter.com/SybreWaaijer/status/2045660722168758336/?rw_tt_thread=True) by [[Sybre Waaijer]] via [[Twitter]]. Published 2026-04-19. Accessed . > “These three combined accounted for roughly 7% of all subscriptions created at checkout that were silently born broken.” Two lines: context and use. Cite data if relevant. [view highlight](https://twitter.com/SybreWaaijer/status/2045660722168758336/?rw_tt_thread=True#H1) #xref #articleseed ID:rw_[MISSING] ### [H2] Single store lost over $43k in MRR > [!quote] [100,000+ stores run this WooCommerce plugin](https://twitter.com/SybreWaaijer/status/2045660722168758336/?rw_tt_thread=True) > “There were 121 affected subscriptions, and $43,274 in lost revenue.” Two lines: context and use. [view highlight](https://twitter.com/SybreWaaijer/status/2045660722168758336/?rw_tt_thread=True#H2) #xref ID:rw_[MISSING] --- ### 🔖 Atomic Split Pad (Zettel Candidates) - Purpose: Promote reusable claims into Atomic notes. - Split level: **H4**. - Each item: one idea, present tense, specific, testable. #### [Z1] Subscription flag state controls revenue reliability - Scope/condition in one line. - Pointer to page/time or dataset. - Links: [[WooCommerce-Subscriptions]] [[Billing-State-Machines]] #### [Z2] Legacy WooCommerce stores risk silent revenue loss - Scope/condition in one line. - Pointer to page/time or dataset. - Links: [[WooCommerce-Audits]] [[Subscription-Reliability]] --- ### ✏️ Fleeting Queue (Extract by Selection) - Purpose: Capture quick actions or sparks for Fleeting notes. - Extraction: **Select one line** → “Refactor: Extract selection to new note (content only).” - Keep each line short and self-contained. - [F1] Draft SQL/CLI script to detect subscriptions with manual payment but gateway tokens — context/https://twitter.com/SybreWaaijer/status/2045660722168758336/?rw_tt_thread=True #fleeting #inbox - [F2] Write guide: “How to audit WooCommerce Subscriptions for silent revenue leaks” — context/https://twitter.com/SybreWaaijer/status/2045660722168758336/?rw_tt_thread=True #fleeting #inbox - [F3] Propose WordCamp talk on subscription reliability patterns — context/https://twitter.com/SybreWaaijer/status/2045660722168758336/?rw_tt_thread=True #fleeting #inbox --- <!-- deep-read:sections end --> 📄 **Full text:** ![[Full Document Contents/Tweets/100,000+ Stores Run This WooCommerce Plugin.md|100,000+ Stores Run This WooCommerce Plugin by Sybre Waaijer]] ## Highlights - Yesterday, I reported a bug to WooCommerce that silently broke subscription payments after a product switch. Then I got worried: if they missed something this obvious, what else did they get wrong? So I started auditing. Within hours, I had found three more bugs. There were 121 affected subscriptions, and $43,274 in lost revenue. ([View Highlight](https://read.readwise.io/read/01kpm4eggngajd5q6v28vf5y2f)) - Tags: 👻 ai highlighted