All categories with matching ID prefix are assigned when saving products (e.g., ‘12’ applies ‘12’, ‘120’, ‘121’)

[ncsramona]

Describe the bug

When you create a product and pick a category, all other categories will be assigned to the product which ID starts with your chosen category ID.

For instance, if I choose the category that has ID 12, then 120, 121 etc categories are assigned to my product.

My setup:

• Storefront 4.6.0
• WooCommerce 9.4.2
• WordPress 6.7.1

In my case, I created 500 categories, so I have several categories that have the following IDs:

• 12
• 120
• 121
• 122
• 123
  and so on. This resulted in my product getting 10 extra, unnecessary categories.

Isolating the problem (mark completed items with an [x]):

• I have deactivated other plugins and themes and confirmed this bug occurs when only WooCommerce + Storefront theme are active.
• I can reproduce this bug consistently using the steps below.

To Reproduce

Steps to reproduce the behavior:

1. Create at least 300 categories in your shop
2. Create a new product
3. Assign a category that has a two digit ID, such as 12
4. Save the product

Instead of assigning the single category I selected, all categories starting with 12 are assigned.

Screenshots

The screenshot below demonstrates two products I created and assigned to the "Test" category. The only difference is "Category test" was created using the Twenty-Twentyfive theme, while product "a" was created using Storefront.

Here's a video as well:
https://github.com/user-attachments/assets/1d5cd58d-1f15-406b-ae3b-cde5c65b8fe4

Expected behavior

Only the category I select should be applied.

Browser Environment

Please provide as much detail as possible about your testing environment.

• Platform: e.g. macOS
• Browser(s): Chrome 131.0.6778.86

WordPress Environment

Please provide relevant details of your WordPress setup and server environment.

Details

``` ` ### WordPress Environment ###

WordPress address (URL): http://testing.local
Site address (URL): http://testing.local
WC Version: 9.4.2
Legacy REST API Package Version: The Legacy REST API plugin is not installed on this site.
Action Scheduler Version: ✔ 3.8.2
Log Directory Writable: ✔
WP Version: 6.7.1
WP Multisite: –
WP Memory Limit: 256 MB
WP Debug Mode: ✔
WP Cron: ✔
Language: en_US
External object cache: –

Server Environment

Server Info: nginx/1.16.0
PHP Version: 8.3.11
PHP Post Max Size: 1,000 MB
PHP Time Limit: 1200
PHP Max Input Vars: 4000
cURL Version: 8.7.1
(SecureTransport) LibreSSL/3.3.6

SUHOSIN Installed: –
MySQL Version: 8.0.16
Max Upload Size: 300 MB
Default Timezone is UTC: ✔
fsockopen/cURL: ✔
SoapClient: ✔
DOMDocument: ✔
GZip: ✔
Multibyte String: ✔
Remote Post: ✔
Remote Get: ✔

Database

WC Database Version: 9.4.2
WC Database Prefix: wp_
Total Database Size: 5.24MB
Database Data Size: 3.53MB
Database Index Size: 1.71MB
wp_woocommerce_sessions: Data: 0.02MB + Index: 0.02MB + Engine InnoDB
wp_woocommerce_api_keys: Data: 0.02MB + Index: 0.03MB + Engine InnoDB
wp_woocommerce_attribute_taxonomies: Data: 0.02MB + Index: 0.02MB + Engine InnoDB
wp_woocommerce_downloadable_product_permissions: Data: 0.02MB + Index: 0.06MB + Engine InnoDB
wp_woocommerce_order_items: Data: 0.02MB + Index: 0.02MB + Engine InnoDB
wp_woocommerce_order_itemmeta: Data: 0.02MB + Index: 0.03MB + Engine InnoDB
wp_woocommerce_tax_rates: Data: 0.02MB + Index: 0.06MB + Engine InnoDB
wp_woocommerce_tax_rate_locations: Data: 0.02MB + Index: 0.03MB + Engine InnoDB
wp_woocommerce_shipping_zones: Data: 0.02MB + Index: 0.00MB + Engine InnoDB
wp_woocommerce_shipping_zone_locations: Data: 0.02MB + Index: 0.03MB + Engine InnoDB
wp_woocommerce_shipping_zone_methods: Data: 0.02MB + Index: 0.00MB + Engine InnoDB
wp_woocommerce_payment_tokens: Data: 0.02MB + Index: 0.02MB + Engine InnoDB
wp_woocommerce_payment_tokenmeta: Data: 0.02MB + Index: 0.03MB + Engine InnoDB
wp_woocommerce_log: Data: 0.02MB + Index: 0.02MB + Engine InnoDB
wp_actionscheduler_actions: Data: 0.02MB + Index: 0.11MB + Engine InnoDB
wp_actionscheduler_claims: Data: 0.02MB + Index: 0.02MB + Engine InnoDB
wp_actionscheduler_groups: Data: 0.02MB + Index: 0.02MB + Engine InnoDB
wp_actionscheduler_logs: Data: 0.02MB + Index: 0.03MB + Engine InnoDB
wp_commentmeta: Data: 0.02MB + Index: 0.03MB + Engine InnoDB
wp_comments: Data: 0.02MB + Index: 0.08MB + Engine InnoDB
wp_links: Data: 0.02MB + Index: 0.02MB + Engine InnoDB
wp_options: Data: 2.47MB + Index: 0.06MB + Engine InnoDB
wp_postmeta: Data: 0.02MB + Index: 0.03MB + Engine InnoDB
wp_posts: Data: 0.06MB + Index: 0.06MB + Engine InnoDB
wp_term_relationships: Data: 0.02MB + Index: 0.02MB + Engine InnoDB
wp_term_taxonomy: Data: 0.02MB + Index: 0.03MB + Engine InnoDB
wp_termmeta: Data: 0.02MB + Index: 0.03MB + Engine InnoDB
wp_terms: Data: 0.02MB + Index: 0.03MB + Engine InnoDB
wp_usermeta: Data: 0.02MB + Index: 0.03MB + Engine InnoDB
wp_users: Data: 0.02MB + Index: 0.05MB + Engine InnoDB
wp_wc_admin_note_actions: Data: 0.02MB + Index: 0.02MB + Engine InnoDB
wp_wc_admin_notes: Data: 0.06MB + Index: 0.00MB + Engine InnoDB
wp_wc_category_lookup: Data: 0.02MB + Index: 0.00MB + Engine InnoDB
wp_wc_customer_lookup: Data: 0.02MB + Index: 0.03MB + Engine InnoDB
wp_wc_download_log: Data: 0.02MB + Index: 0.03MB + Engine InnoDB
wp_wc_order_addresses: Data: 0.02MB + Index: 0.06MB + Engine InnoDB
wp_wc_order_coupon_lookup: Data: 0.02MB + Index: 0.03MB + Engine InnoDB
wp_wc_order_operational_data: Data: 0.02MB + Index: 0.03MB + Engine InnoDB
wp_wc_order_product_lookup: Data: 0.02MB + Index: 0.06MB + Engine InnoDB
wp_wc_order_stats: Data: 0.02MB + Index: 0.05MB + Engine InnoDB
wp_wc_order_tax_lookup: Data: 0.02MB + Index: 0.03MB + Engine InnoDB
wp_wc_orders: Data: 0.02MB + Index: 0.11MB + Engine InnoDB
wp_wc_orders_meta: Data: 0.02MB + Index: 0.03MB + Engine InnoDB
wp_wc_product_attributes_lookup: Data: 0.02MB + Index: 0.02MB + Engine InnoDB
wp_wc_product_download_directories: Data: 0.02MB + Index: 0.02MB + Engine InnoDB
wp_wc_product_meta_lookup: Data: 0.02MB + Index: 0.11MB + Engine InnoDB
wp_wc_rate_limits: Data: 0.02MB + Index: 0.02MB + Engine InnoDB
wp_wc_reserved_stock: Data: 0.02MB + Index: 0.00MB + Engine InnoDB
wp_wc_tax_rate_classes: Data: 0.02MB + Index: 0.02MB + Engine InnoDB
wp_wc_webhooks: Data: 0.02MB + Index: 0.02MB + Engine InnoDB

Post Type Counts

attachment: 1
page: 7
post: 2
product: 11
revision: 1
wp_navigation: 1

Security

Secure connection (HTTPS): ❌
Your store is not using HTTPS. Learn more about HTTPS and SSL Certificates.
Hide errors from visitors: ✔

Active Plugins (1)

WooCommerce: by Automattic – 9.4.2

Inactive Plugins (0)

Settings

Legacy API Enabled: –
Force SSL: –
Currency: USD ($)
Currency Position: left
Thousand Separator: ,
Decimal Separator: .
Number of Decimals: 2
Taxonomies: Product Types: external (external)
grouped (grouped)
simple (simple)
variable (variable)

Taxonomies: Product Visibility: exclude-from-catalog (exclude-from-catalog)
exclude-from-search (exclude-from-search)
featured (featured)
outofstock (outofstock)
rated-1 (rated-1)
rated-2 (rated-2)
rated-3 (rated-3)
rated-4 (rated-4)
rated-5 (rated-5)

Connected to WooCommerce.com: –
Enforce Approved Product Download Directories: ✔
HPOS feature enabled: ✔
Order datastore: Automattic\WooCommerce\Internal\DataStores\Orders\OrdersTableDataStore
HPOS data sync enabled: –

Logging

Enabled: ✔
Handler: Automattic\WooCommerce\Internal\Admin\Logging\LogHandlerFileV2
Retention period: 30 days
Level threshold: –
Log directory size: 158 B

WC Pages

Shop base: #7 - /shop/
Cart: #8 - /cart/ - Contains the woocommerce/cart block
Checkout: #9 - /checkout/ - Contains the woocommerce/checkout block
My account: #10 - /my-account/
Terms and conditions: ❌ Page not set

Theme

Name: Storefront
Version: 4.6.0
Author URL: https://woocommerce.com/
Child Theme: ❌ – If you are modifying WooCommerce on a parent theme that you did not build personally we recommend using a child theme. See: How to create a child theme
WooCommerce Support: ✔

Templates

Overrides: –

Admin

Enabled Features: activity-panels
analytics
product-block-editor
coupons
core-profiler
customize-store
customer-effort-score-tracks
import-products-task
experimental-fashion-sample-products
shipping-smart-defaults
shipping-setting-tour
homescreen
marketing
mobile-app-banner
navigation
onboarding
onboarding-tasks
pattern-toolkit-full-composability
product-custom-fields
remote-inbox-notifications
remote-free-extensions
payment-gateway-suggestions
printful
shipping-label-banner
subscriptions
store-alerts
transient-notices
woo-mobile-welcome
wc-pay-promotion
wc-pay-welcome-page
launch-your-store

Disabled Features: product-data-views
experimental-blocks
minified-js
product-pre-publish-modal
settings
async-product-editor-category-field
product-editor-template-system
blueprint
reactify-classic-payments-settings
use-wp-horizon

Daily Cron: ✔ Next scheduled: 2024-11-28 06:24:16 +00:00
Options: ✔
Notes: 56
Onboarding: skipped

Action Scheduler

Complete: 8
Oldest: 2024-11-27 06:25:37 +0000
Newest: 2024-11-27 10:12:49 +0000

Failed: 1
Oldest: 2024-11-27 09:50:58 +0000
Newest: 2024-11-27 09:50:58 +0000

Pending: 1
Oldest: 2024-11-28 06:25:37 +0000
Newest: 2024-11-28 06:25:37 +0000

Status report information

Generated at: 2024-11-27 10:14:54 +00:00

</details>

[OmarFPG]

9087505-zd-a8c the merchant reports the issue is also present using the Twenty Sixteen theme. I was able to replicate this with TT4, noticed it started happening at 200 categories in. And it happens both for updating and creating products.

[nwdgithub]

Hello, Has there been any updates on this? Customers sites are left vulnerable as they cannot upgrade past 6.6.2 and missing recent releases of security updates for WordPress Core.

[OmarFPG]

This has been reported in WooCommerce core here: woocommerce/woocommerce#53630