--- title: "WooCommerce 11.3 removes the legacy MCP endpoint and abilities: 2026-10-21 | Harbyn" description: "WooCommerce 11.3 removes the legacy MCP endpoint and abilities, announced Oct 21, 2026." canonical: "https://harbyn.com/changes/woocommerce/2026-10-21-woocommerce-11-3-mcp-adaptor-updates" last-updated: 2026-10-25 --- # WooCommerce 11.3 removes the legacy MCP endpoint and abilities Markdown version of . Breaking change - WooCommerce. high severity. In effect. WooCommerce 11.3 removes /wp-json/woocommerce/mcp (HTTP 410), its REST API key authentication and legacy REST-derived abilities and filters. Before upgrading, install the WordPress MCP Adapter plugin and connect to /wp-json/mcp/mcp-adapter-default-server using a WordPress application password. Custom abilities must opt in with MCP metadata; extensions must not rely on WooCommerce to bundle MCP Adapter classes. ## Facts | Fact | Value | | --- | --- | | Vendor | [WooCommerce](https://harbyn.com/vendors/woocommerce.md) | | Kind | Breaking change | | Severity | high | | Status | In effect | | Announced | Oct 21, 2026 | | Added to Harbyn | Oct 25, 2026 | | Lead time | No dated deadline | | Symbols | `X-MCP-API-Key`, `woocommerce/products-list`, `woocommerce/products-get`, `woocommerce/products-create`, `woocommerce/products-update`, `woocommerce/products-delete`, `woocommerce/orders-list`, `woocommerce/orders-get`, `woocommerce/orders-create`, `woocommerce/orders-update`, `woocommerce_mcp_include_ability`, `woocommerce_mcp_allow_insecure_transport`, `woocommerce_check_rest_ability_permissions_for_method`, `expose_in_deprecated_woocommerce_mcp` | | Endpoints | `ANY /wp-json/woocommerce/mcp` | | Vendor page | | | Review | Reviewed by a person, extracted by a model | ## Find it in your code ```sh npx harbyn scan ``` The scanner reads your repository on your machine and reports every file and line that uses the identifiers above. Nothing leaves your machine. ## Sources Where this event comes from: the page we read, when we read it, and the hash of that snapshot. - (changelog, fetched 2026-10-22 03:34 UTC, sha256 `c021f19f4072c9b55a9c2209a689596266412ca151e4a0e80490b57dc1585c6e`) ## Related changes ### More from WooCommerce - [Classic checkout address handling restored](https://harbyn.com/changes/woocommerce/2026-10-09-woocommerce-11-2-1-release-notes.md) (Behavior change, announced Oct 9, 2026) - [Checkout block postcode validation fixed](https://harbyn.com/changes/woocommerce/2026-10-09-woocommerce-11-2-1-release-notes-2.md) (Behavior change, announced Oct 9, 2026) - [WooCommerce 11.6 will require PHP 8.1 or newer](https://harbyn.com/changes/woocommerce/2026-09-29-new-requirement-for-woocommerce-11-6-php-8-1.md) (Breaking change, effective Feb 2027) - [Experimental Dual API engine removed from WooCommerce core](https://harbyn.com/changes/woocommerce/2026-09-28-the-experimental-woocommerce-dual-api-is-now-a-plugin.md) (Breaking change, effective Oct 7, 2026) ### Changes at other vendors - [Amazon Selling Partner API: October listing attribute usage and enumeration value updates](https://harbyn.com/changes/amazon-sp-api/2026-10-14-sp-api-updates-new-listings-items-api-ivp-values-in-eu5-jp-and-ca-stores-oct-2.md) (effective Oct 26, 2026) - [Supabase: four CBC-mode TLS 1.2 cipher suites will be removed from project HTTP APIs](https://harbyn.com/changes/supabase/2026-10-12-an-outdated-subset-of-tls-1-2-ciphers-will-be-disabled-on-project-http-apis.md) (effective Nov 10, 2026) - [Google Workspace APIs: OAuth clients must be marked as agentic to call Google Workspace MCP servers](https://harbyn.com/changes/google-workspace/2026-10-12-oauth-clients-must-be-marked-as-agentic-to-call-google-workspace-mcp-servers.md) (effective Nov 11, 2026) - [Bitbucket Cloud API: Git Credential Manager upgrade required for OAuth 2.0 Git authentication](https://harbyn.com/changes/bitbucket/2026-10-13-git-credential-manager-upgrade-required-for-oauth-2-0-git-authentication.md) (effective Nov 30, 2026) [All upcoming deadlines](https://harbyn.com/deadlines.md)