What is the CVSS score of CVE-2025-64296?

CVE-2025-64296 has a CVSS 3.1 base score of 5.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.0%.

WordPress CVE-2025-64296

MEDIUM

Missing Authorization (CWE-862)

2025-10-29 audit@patchstack.com

WordPress Authentication Bypass

5.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

5.3 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

CVSS changed

Apr 23, 2026 - 15:43 NVD

5.3 (MEDIUM)

Analysis Generated

Apr 01, 2026 - 17:44 vuln.today

CVE Published

Oct 29, 2025 - 04:16 nvd

N/A

DescriptionCVE.org

Missing Authorization vulnerability in Facebook Facebook for WooCommerce facebook-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Facebook for WooCommerce: from n/a through <= 3.5.7.

AnalysisAI

Missing authorization in Facebook for WooCommerce plugin versions up to 3.5.7 allows authenticated attackers to bypass access controls and dismiss administrative notices through incorrectly configured security levels. The vulnerability enables privilege escalation or information disclosure via improper access control enforcement, though the low EPSS score (0.03%, 9th percentile) suggests limited real-world exploitation likelihood despite the broken access control flaw.

Technical ContextAI

This vulnerability involves a missing or improperly enforced authorization check in the Facebook for WooCommerce WordPress plugin, classified under CWE-862 (Missing Authorization). The plugin fails to properly validate user permissions when processing notice dismissal operations, allowing attackers with basic authentication to perform actions restricted to higher-privilege users. The issue is rooted in inconsistent or missing capability checks in WordPress plugin hook handlers that manage administrative UI state, a common pattern in WordPress where add_action('wp_ajax_nopriv_*') or insufficient capability verification creates authorization gaps.

Affected ProductsAI

Facebook for WooCommerce WordPress plugin is affected in versions from initial release through 3.5.7. The plugin integrates WooCommerce e-commerce functionality with Facebook catalog and marketing features. Users running any version of the plugin at or below 3.5.7 are vulnerable. The plugin is distributed via the WordPress Plugin Directory and is commonly deployed on WooCommerce-powered online stores.

RemediationAI

Update Facebook for WooCommerce to version 3.5.8 or later once available from the official WordPress Plugin Directory. Until a patched version is released, administrators should review user role assignments and restrict WordPress user capabilities to trusted personnel only, limiting access to the WooCommerce and Facebook integration settings. For immediate containment, disable the Facebook for WooCommerce plugin if not actively in use. Consult the Patchstack advisory (https://patchstack.com/database/Wordpress/Plugin/facebook-for-woocommerce/vulnerability/wordpress-facebook-for-woocommerce-plugin-3-5-7-broken-access-control-to-notice-dismissal-vulnerability) for vendor-specific remediation guidance and confirmation of patch availability.