I think I found a bug with the latest Woodmart Core plugin that is causing significant server load across multiple WooCommerce sites running the latest version of Woodmart.
The issue is in the Composer autoloader files within woodmart-core/vendor/composer/. Specifically, autoload_namespaces.php registers an empty namespace (”) that maps to three opauth directories:
– vendor/opauth/vkontakte
– vendor/opauth/facebook
– vendor/opauth/google
Because the namespace is empty, PHP’s autoloader checks these three directories for EVERY class it tries to load — not just opauth-related classes. This means every single class loaded by WordPress, WooCommerce, Elementor, Rank Math, or any other plugin triggers three failed filesystem lookups (ENOENT) before finding the correct file.
On a typical WooCommerce page load that loads hundreds of classes, this results in hundreds of unnecessary failed file access attempts per request. Under any real traffic, this causes php-fpm processes to run significantly longer than they should, high CPU usage, and overall server degradation.
I confirmed this via strace on php-fpm processes, which showed the repeated pattern:
access to Woodmart-core/vendor/composer
/opauth/vkontakte/…”
/opauth/facebook/…”
/opauth/google/…”
all resulted in enoent
…followed by the correct file being found elsewhere.
The fix is to remove the opauth references from these files:
– autoload_namespaces.php (the empty namespace entry)
– autoload_static.php (lines referencing opauth directories)
– autoload_classmap.php (opauth class entries)
It appears opauth was used for social login functionality but the namespace registration is far too broad. Either the opauth packages should be removed from the autoloader entirely, or they should be registered under their own specific namespace rather than the empty catch-all.
This affects every site running Woodmart Core regardless of whether social login features are being used.
.
