Lifecycle Timeline
2DescriptionNVD
Missing Authorization vulnerability in Facebook Facebook for WooCommerce facebook-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Facebook for WooCommerce: from n/a through <= 3.5.7.
AnalysisAI
Missing authorization in Facebook for WooCommerce plugin versions up to 3.5.7 allows authenticated attackers to bypass access controls and dismiss administrative notices through incorrectly configured security levels. The vulnerability enables privilege escalation or information disclosure via improper access control enforcement, though the low EPSS score (0.03%, 9th percentile) suggests limited real-world exploitation likelihood despite the broken access control flaw.
Technical ContextAI
This vulnerability involves a missing or improperly enforced authorization check in the Facebook for WooCommerce WordPress plugin, classified under CWE-862 (Missing Authorization). The plugin fails to properly validate user permissions when processing notice dismissal operations, allowing attackers with basic authentication to perform actions restricted to higher-privilege users. The issue is rooted in inconsistent or missing capability checks in WordPress plugin hook handlers that manage administrative UI state, a common pattern in WordPress where add_action('wp_ajax_nopriv_*') or insufficient capability verification creates authorization gaps.
Affected ProductsAI
Facebook for WooCommerce WordPress plugin is affected in versions from initial release through 3.5.7. The plugin integrates WooCommerce e-commerce functionality with Facebook catalog and marketing features. Users running any version of the plugin at or below 3.5.7 are vulnerable. The plugin is distributed via the WordPress Plugin Directory and is commonly deployed on WooCommerce-powered online stores.
RemediationAI
Update Facebook for WooCommerce to version 3.5.8 or later once available from the official WordPress Plugin Directory. Until a patched version is released, administrators should review user role assignments and restrict WordPress user capabilities to trusted personnel only, limiting access to the WooCommerce and Facebook integration settings. For immediate containment, disable the Facebook for WooCommerce plugin if not actively in use. Consult the Patchstack advisory (https://patchstack.com/database/Wordpress/Plugin/facebook-for-woocommerce/vulnerability/wordpress-facebook-for-woocommerce-plugin-3-5-7-broken-access-control-to-notice-dismissal-vulnerability) for vendor-specific remediation guidance and confirmation of patch availability.
Share
External POC / Exploit Code
Leaving vuln.today