The symptom
- Dashboard shows pending core/WooCommerce updates for months; PHP 7.x on the host.
- Schema lacks fields that newer versions add (GTIN, brand); security scanners flag known CVEs.
Why it matters
WooCommerce added the native GTIN field in 9.2 and Brands in 9.6; older versions cannot produce the identifiers Google and AI assistants want. Unpatched cores and plugins are what attackers scan for daily — a hacked shop gets flagged by Safe Browsing and disappears from every result.
How to check it yourself
- WordPress → Dashboard → Updates; WooCommerce → Status → *WordPress environment*.
How to fix it
- Take a full backup; update on staging first if you have one.
- Update PHP to 8.2+, then WordPress core, then WooCommerce, then plugins and theme (in that order), testing cart and checkout after each step.
- Enable auto-updates for minor core releases and security-only plugin updates; schedule a monthly manual update window.