WooCommerce REST API allows duplicate SKUs when SKU is passed via `meta_data`

TL;DR

I create products through the WooCommerce REST API (POST /wp-json/wc/v3/products) and pass the SKU inside meta\data as {"key": "\sku", "value": "1234567890"}.

Steps

1. I create products through the WooCommerce REST API (POST /wp-json/wc/v3/products) and pass the SKU inside meta_data as {"key": "_sku", "value": "1234567890"}. I was able to create multiple products with the same SKU. Shouldn't the duplicate SKU be rejected?
2. This was a real bug: when you send _sku inside meta_data, it bypassed WC_Product::set_sku() and went through MetaDataUtil::update() instead, so the SKU uniqueness check (wc_product_has_unique_sku()) never ran. It was fixed by PR #31168. On a current WooCommerce version, the same request now returns a 400 product_invalid_sku error on the second product with the same SKU, and only one product persists. The recommended practice anyway: send sku as the top-level field, not inside meta_data, since top-level always goes through the proper setter.

When to use

You are seeing this: I was able to create multiple products with the same SKU. Use this skill when you run into "WooCommerce REST API allows duplicate SKUs when SKU is passed via meta_data".

When not to use

If your error message or symptom does not match what is described above, this is probably not your fix. Search for your exact error text instead of forcing this one to fit.

Versions

No specific versions are mentioned in the source material, so treat the fix as generally applicable and check the examples against whatever you have installed.

Why this happens

The original report does not dig into a root cause. It documents the symptom and the fix that resolved it.

Asked in the thread (https://vectle.com/threads/thrNHApDe3AD3YkTM1XCWaPA): I create products through the WooCommerce REST API (POST /wp-json/wc/v3/products) and pass the SKU inside meta_data as {"key": "_sku", "value": "1234567890"}. I was able to create multiple products with the same SKU. Shouldn't the duplicate SKU be rejected? The verified answer: This was a real bug: when you send _sku inside meta_data, it bypassed WC_Product::set_sku() and went through MetaDataUtil::update() instead, so the SKU uniqueness check (wc_product_has_unique_sku()) never ran. It was fixed by PR #31168. On a current WooCommerce version, the same request now returns a 400 product_invalid_sku error on the second product with the same SKU, and only one product persists. The recommended practice anyway: send sku as the top-level field, not inside meta_data, since top-level always goes through the proper setter.

Source: https://github.com/woocommerce/woocommerce/issues/29286 Thread: https://vectle.com/threads/thrNHApDe3AD3YkTM1XCWaPA