Is CVE-2026-49059 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-49059 being exploited in the wild.

How severe is CVE-2026-49059?

Medium severity, with a CVSS score of 4.7, published 27 May 2026.

Which products and versions are affected?

Meta Facebook for WooCommerce n/a through 3.7.0.

Is there a fix for CVE-2026-49059?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-49059 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-49059?

Check whether you run Meta Facebook for WooCommerce at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-49059: Facebook Facebook for WooCommerce open redirect

CVE-2026-49059 · Severity: medium · CVSS 4.7 · Published 2026-05-27

The Facebook for WooCommerce plugin, which connects WordPress e-commerce sites to Facebook services, contains a security flaw that allows for open redirects. An attacker can use a legitimate link from your website to trick users into visiting a malicious or fraudulent site. This is primarily used in phishing campaigns to steal user credentials or distribute malware by leveraging the trust associated with your domain.

Vendors: Meta.

Quick answers

Is CVE-2026-49059 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-49059 being exploited in the wild.
How severe is CVE-2026-49059?: Medium severity, with a CVSS score of 4.7, published 27 May 2026.
Which products and versions are affected?: Meta Facebook for WooCommerce n/a through 3.7.0.
Is there a fix for CVE-2026-49059?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-49059 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-49059?: Check whether you run Meta Facebook for WooCommerce at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

An open redirect vulnerability (CWE-601) exists in the Facebook for WooCommerce plugin for WordPress through version 3.7.0. The software fails to properly validate user-supplied input used in redirection targets, allowing a remote, unauthenticated attacker to craft a URL that redirects victims to an arbitrary external domain. Exploitation requires a user to click a specially crafted link. This flaw is typically leveraged in phishing campaigns to bypass security filters and lend credibility to malicious URLs. As of the advisory date, no official patch has been confirmed.

Affected products

Facebook Facebook for WooCommerce n/a through 3.7.0

Timeline

2026-02-02: other: Reported by researcher timomangcut
2026-05-27: advisory: Published by Patchstack
2026-05-27: disclosed: NVD publication date

References

https://patchstack.com/database/wordpress/plugin/facebook-for-woocommerce/vulnerability/wordpress-facebook-for-woocommerce-plugin-3-7-0-open-redirection-vulnerability?_s_id=cve

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.