CVE-2026-49059: Facebook for WooCommerce Open Redirect Flaw

CVE-2026-49059 Overview

CVE-2026-49059 is an open redirect vulnerability in the Facebook for WooCommerce WordPress plugin. The flaw affects all versions from initial release through 3.7.0. The plugin fails to validate user-supplied URLs before performing redirects, allowing attackers to craft links that send victims from a trusted WooCommerce site to attacker-controlled destinations. This weakness is classified under [CWE-601] (URL Redirection to Untrusted Site).

The vulnerability enables phishing campaigns that abuse the legitimate domain of the affected WooCommerce store to bypass user suspicion and email security filters.

Critical Impact
Attackers can use vulnerable WooCommerce sites as redirect launchpads to phishing pages, leveraging the store's trusted domain to harvest credentials or deliver malware.

Affected Products

Facebook for WooCommerce plugin versions through 3.7.0
WordPress sites running the Facebook for WooCommerce integration
WooCommerce storefronts using Facebook commerce features

Discovery Timeline

2026-05-27 - CVE-2026-49059 published to NVD
2026-05-27 - Last updated in NVD database

Technical Details for CVE-2026-49059

Vulnerability Analysis

The Facebook for WooCommerce plugin contains a redirect endpoint that accepts a destination URL as a parameter. The plugin does not enforce an allowlist of trusted hosts or validate that the target URL belongs to the same origin. An attacker can supply an arbitrary external URL and the plugin will issue an HTTP redirect to that destination.

Because the initial URL belongs to the legitimate WooCommerce site, the request appears trustworthy to users, mail gateways, and link-scanning tools. Successful exploitation requires user interaction such as clicking a crafted link delivered via email, chat, or social media.

The scope-changing impact means a single click can route a victim from the merchant domain to an attacker-controlled phishing page that mimics Facebook, WooCommerce, or payment provider login flows.

Root Cause

The root cause is missing input validation on a redirect parameter. The plugin trusts the supplied URL and calls a redirect function without restricting the host to the site's own domain or a vetted allowlist. This is a classic [CWE-601] pattern where the application acts on attacker-controlled location data.

Attack Vector

The attack vector is network based and requires no authentication. An attacker constructs a URL pointing to the vulnerable plugin endpoint on a target WooCommerce site with a malicious destination encoded in the redirect parameter. The attacker then distributes the link through phishing email, smishing, malicious advertisements, or social media posts. When a victim clicks, their browser is silently redirected to the attacker's phishing site.

Technical details of the vulnerable parameter and endpoint are documented in the Patchstack Vulnerability Report.

Detection Methods for CVE-2026-49059

Indicators of Compromise

Web server access logs containing requests to Facebook for WooCommerce plugin endpoints with external URLs in query parameters
Outbound HTTP 301 or 302 responses from the WooCommerce site pointing to domains unrelated to the merchant or Facebook
Spike in referrer traffic from the WooCommerce domain to newly registered or low-reputation domains
User reports of phishing emails containing links to the legitimate store domain

Detection Strategies

Inspect web access logs for redirect parameters containing fully qualified URLs with hosts outside the site's own domain
Deploy WAF rules that flag requests to plugin paths carrying http:// or https:// values in query strings
Correlate email security telemetry with web traffic to identify phishing campaigns abusing the merchant domain

Monitoring Recommendations

Monitor WordPress and WooCommerce plugin inventories for installations of Facebook for WooCommerce at or below version 3.7.0
Alert on HTTP redirect responses where the Location header host does not match the site's own domain or an approved allowlist
Track brand-abuse intelligence feeds for phishing domains that reference the affected merchant store

How to Mitigate CVE-2026-49059

Immediate Actions Required

Identify all WordPress sites running Facebook for WooCommerce and confirm the installed version
Update the plugin to a version newer than 3.7.0 as soon as a fixed release is published by the vendor
Review recent web logs for suspicious redirect activity and notify affected users if phishing abuse is identified

Patch Information

The vulnerability affects Facebook for WooCommerce through version 3.7.0. Administrators should consult the Patchstack Vulnerability Report and the WordPress plugin repository for the latest fixed version and upgrade guidance.

Workarounds

Deploy a WAF rule that blocks requests to the plugin's redirect endpoint when the destination parameter contains an external host
Temporarily disable the Facebook for WooCommerce plugin if business operations allow until a patched version is installed
Educate users and customers to verify the final destination of links before submitting credentials, especially after redirects from the store domain

bash

# Example WAF rule (ModSecurity) to block external redirect targets
SecRule REQUEST_URI "@contains /wp-content/plugins/facebook-for-woocommerce/" \
    "chain,deny,status:403,id:1004959,msg:'Blocked external open redirect attempt (CVE-2026-49059)'"
    SecRule ARGS "@rx ^https?://(?!yourdomain\.com)" "t:none,t:lowercase"