CVE-2026-49059

MediumCVSS 4.7

Published: 27/05/2026(UTC)Updated: 26/10/2026(UTC)Translated: 26/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.23%

14th percentile - higher than 14% of all known CVEs

Summary

The Facebook for WooCommerce plugin contains an Open Redirect vulnerability that enables phishing attacks. The issue affects versions from n/a through 3.7.0.

Risk Assessment

An attacker can abuse the store's trusted domain to redirect users to malicious sites, facilitating phishing and credential theft. The risk affects sites running the vulnerable plugin version.

Recommendation

Update the Facebook for WooCommerce plugin to a version later than 3.7.0. Until then, consider server-side validation of redirect parameters.

Other vulnerabilities in Facebook for WooCommerce

CVE-2026-66707High
Cross Site Scripting (XSS) vulnerability in Facebook for WooCommerce plugin up to version 3.7.5, allowing an unauthenticated attacker to inject malicious scripts into pages.

Original NVD description (English source)

URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Facebook Facebook for WooCommerce allows Phishing. This issue affects Facebook for WooCommerce: from n/a through 3.7.0.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS