# CVE-2026-49059: Facebook Facebook for WooCommerce open redirect

Source: https://junglewise.ai/threats/cve-2026-49059-facebook-facebook-for-woocommerce-open-redirect  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-05-27. Updated: 2026-05-27  
License: CC BY 4.0 with a link back

CVE-2026-49059 · Severity: medium · CVSS 4.7 · Published 2026-05-27

The Facebook for WooCommerce plugin, which connects WordPress e-commerce sites to Facebook services, contains a security flaw that allows for open redirects. An attacker can use a legitimate link from your website to trick users into visiting a malicious or fraudulent site. This is primarily used in phishing campaigns to steal user credentials or distribute malware by leveraging the trust associated with your domain.

Vendors: [Meta](https://junglewise.ai/threats/vendors/meta).

## Quick answers

**Is CVE-2026-49059 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-49059 being exploited in the wild.

**How severe is CVE-2026-49059?** Medium severity, with a CVSS score of 4.7, published 27 May 2026.

**Which products and versions are affected?** Meta Facebook for WooCommerce n/a through 3.7.0.

**Is there a fix for CVE-2026-49059?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-49059 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-49059?** Check whether you run Meta Facebook for WooCommerce at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

An open redirect vulnerability (CWE-601) exists in the Facebook for WooCommerce plugin for WordPress through version 3.7.0. The software fails to properly validate user-supplied input used in redirection targets, allowing a remote, unauthenticated attacker to craft a URL that redirects victims to an arbitrary external domain. Exploitation requires a user to click a specially crafted link. This flaw is typically leveraged in phishing campaigns to bypass security filters and lend credibility to malicious URLs. As of the advisory date, no official patch has been confirmed.

## Affected products

- Facebook Facebook for WooCommerce n/a through 3.7.0

## Timeline

- 2026-02-02: other: Reported by researcher timomangcut
- 2026-05-27: advisory: Published by Patchstack
- 2026-05-27: disclosed: NVD publication date

## References

- [https://patchstack.com/database/wordpress/plugin/facebook-for-woocommerce/vulnerability/wordpress-facebook-for-woocommerce-plugin-3-7-0-open-redirection-vulnerability?_s_id=cve](https://patchstack.com/database/wordpress/plugin/facebook-for-woocommerce/vulnerability/wordpress-facebook-for-woocommerce-plugin-3-7-0-open-redirection-vulnerability?_s_id=cve)

## Related threats

- [Meta Facebook for WooCommerce unauthenticated XSS](https://junglewise.ai/threats/cve-2026-66707-meta-facebook-for-woocommerce-unauthenticated-xss)