EUVD-2026-32529
GHSA-6f96-4hg2-638g
Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N
Lifecycle Timeline
2DescriptionCVE.org
URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Facebook Facebook for WooCommerce allows Phishing.
This issue affects Facebook for WooCommerce: from n/a through 3.7.0.
AnalysisAI
Open redirect in the Facebook for WooCommerce WordPress plugin (versions through 3.7.0) allows unauthenticated remote attackers to redirect victims to arbitrary external domains via crafted URLs. Classified under CWE-601, the vulnerability enables phishing campaigns that abuse the plugin's trusted WooCommerce domain as a delivery mechanism - victims clicking a link that appears to originate from a legitimate storefront are silently forwarded to attacker-controlled sites. No public exploit code and no active exploitation (CISA KEV) have been identified at time of analysis; EPSS data was not available in the provided intelligence.
Technical ContextAI
The Facebook for WooCommerce plugin (a Meta-developed WordPress e-commerce integration) fails to validate or restrict the destination URL in a redirect parameter, satisfying the CWE-601 definition of URL Redirection to an Untrusted Site. The CVSS scope flag S:C (Changed) confirms that the impact crosses the security boundary of the originating application - the victim's browser is taken outside the WordPress/WooCommerce trust context entirely. The affected CPE covers all plugin releases from an unspecified starting version through 3.7.0. Vulnerability discovery was attributed to Patchstack's audit team (audit@patchstack.com), a specialized WordPress security research organization, lending credibility to the finding.
RemediationAI
Update the Facebook for WooCommerce plugin to a version beyond 3.7.0 via the WordPress plugin dashboard or by downloading directly from the WordPress plugin repository. An exact confirmed fix version was not independently verifiable from the available intelligence - the Patchstack advisory at https://patchstack.com/database/wordpress/plugin/facebook-for-woocommerce/vulnerability/wordpress-facebook-for-woocommerce-plugin-3-7-0-open-redirection-vulnerability should be consulted for the confirmed patched release. As a compensating control pending patching, administrators can implement a Web Application Firewall (WAF) rule that inspects and blocks outbound redirect parameters containing external domains - note this may interfere with legitimate plugin redirect flows. Additionally, disabling the plugin entirely until patched eliminates exposure at the cost of Meta/Facebook commerce integration functionality.
More in Open Redirect
View allA malicious third-party can give a crafted "ssh://..." URL to an unsuspecting victim, and an attempt to visit the URL ca
GFI Kerio Control versions 9.2.5 through 9.4.5 contain an HTTP response splitting vulnerability in the dest parameter of
PHP through 7.0.8 does not attempt to address RFC 3875 section 4.1.18 namespace conflicts and therefore does not protect
Multiple open redirect vulnerabilities in Apache Struts 2.0.0 through 2.3.15 allow remote attackers to redirect users to
Open redirect vulnerability in age-verification.php in the Age Verification plugin 0.4 and earlier for WordPress allows
Open redirect vulnerability in Kaseya Virtual System Administrator (VSA) 7.x before 7.0.0.29, 8.x before 8.0.0.18, 9.0 b
Vulnerability in the Oracle Applications Framework component of Oracle E-Business Suite (subcomponent: Popup windows (li
Unspecified vulnerability in the Oracle Application Server Single Sign-On component in Oracle Fusion Middleware 10.1.4.3
Flarum is open source discussion platform software. Rated medium severity (CVSS 6.5), this vulnerability is remotely exp
Open redirect vulnerability in Novius OS 5.0.1 (Elche) allows remote attackers to redirect users to arbitrary web sites
Open redirect vulnerability in the Redirect function in stageshow_redirect.php in the StageShow plugin before 5.0.9 for
Nteract v.0.28.0 was discovered to contain a remote code execution (RCE) vulnerability via the Markdown link. Rated crit
Share
External POC / Exploit Code
Leaving vuln.today