Before you use this guide
Updated October 11, 2026. WooCommerce 11.2 is now released, and 11.2.1 is available. The lab results below remain from September 26 testing on 11.2.0-beta.1 with WordPress 7.1.2; these quantity-rule fixtures have not yet been repeated on the final release. Repeat these checks on your installed release before deploying changes to a live store.
A customer changes a product’s quantity beyond your store’s limit. Your classic cart rejects it, but the Cart Block accepts it. One possible cause is that your custom validation only handles the classic cart.
WooCommerce 11.2 introduces woocommerce_store_api_cart_item_quantity_validation. The existing woocommerce_update_cart_validation hook remains specific to shortcode carts. Read the official developer advisory.
What developers need to change
Keep the classic-cart callback and add the corresponding Store API validation.
The new filter receives the current validation result, requested quantity, product, and cart item. Return a WP_Error to reject the change. The Store API responds with HTTP 400 and supplies the error message for the shopper-facing interface. Returning false or calling wc_add_notice() does not reject the change through this filter. See the official hook documentation.
A quantity-update rule is not complete add-to-cart protection
The new filter covers quantity updates and adding more of a product already in the cart. It does not cover that product’s first addition; WooCommerce identifies woocommerce_store_api_validate_add_to_cart as the separate action for that path.
It also runs after core minimum, maximum, and multiple-of validation. For ordinary numeric limits, check the Store API product-quantity filters rather than relying solely on a custom rejection callback. Review the filter’s scope and limits.
What our beta testing found
In Cobalt Branch Labs’ disposable Checkout Diagnostics installation, a temporary maximum-two fixture accepted quantity two. A request for quantity three returned HTTP 400 with an invalid_quantity error. Cart-total diagnostics continued to pass for a valid quantity.
Separate CacheSafe testing confirmed that a rejected quantity update left the cart unchanged and was not misclassified as a cross-session leak.
These results cover controlled beta fixtures. They do not establish that every quantity extension, theme, or custom checkout works correctly.
How to test your store’s rule
Use a staging copy and test each relevant path:
- Add the product to an empty cart.
- Increase its quantity within the allowed range.
- Attempt a quantity beyond the rule.
- Add the same product again from its product page.
- Repeat in classic and block-based carts.
- Check the error message, retained quantity, and recalculated totals.
Include guest and logged-in customers. Record the exact WooCommerce version and whether the rejection came from your custom rule or a built-in product limit.
Where Cobalt’s diagnostic plugins fit
Cobalt Checkout Diagnostics helps inspect checkout diagnostics and cart-total consistency. CacheSafe investigates cart/session isolation and caching evidence.
Neither plugin implements your store’s quantity policy. Use diagnostic results alongside direct tests of the extension or custom code that enforces it.
WooCommerce 11.2.1 is now available. Repeat the focused quantity-rule checks against the release you plan to use. Read the 11.2.1 release notes.