5.3Mittel

CVE-2025-64296WordPress Facebook for WooCommerce plugin <= 3.5.7 - Broken Access Control to Notice Dismissal vulnerability

Facebook Facebook for WooCommerce Veröffentlicht: 2025-10-29 07:08 (vor 1 Jahr)

Beschreibung

Missing Authorization vulnerability in Facebook Facebook for WooCommerce facebook-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Facebook for WooCommerce: from n/a through <= 3.5.7.

Schwachstellentyp (CWE): CWE-862

Daten: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Wiedergegeben wie in der Quelle, auf Englisch.

Betroffene Produkte und Versionen

Hersteller	Produkt	Versionen
Facebook	Facebook for WooCommerce	≤ 3.5.7

Referenzen und Patches

https://patchstack.com/database/Wordpress/Plugin/facebook-for-woocommerce/vulnerability/wordpress-facebook-fo… vdb-entry

CVSS-Score

5.3Mittel

Quelle: Patchstack · CVSS 3.1

Angriffsvektor: Netzwerk
Komplexität: Niedrig
Rechte erforderlich: Keine
Benutzerinteraktion: Keine
Geltungsbereich: Unverändert
Vertraulichkeit: Keine
Integrität: Niedrig
Verfügbarkeit: Keine

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Alle Scores (2)

cna	CVSS 3.1	5.3Mittel
audit@patchstack.com	CVSS 3.1	5.3Mittel

EPSS (Ausnutzungswahrscheinlichkeit in 30 Tagen)

0.22%

höher als 12 % aller CVEs

CISA-Bewertung (SSVC)

Ausnutzung: none
Automatisierbar: yes
Technische Auswirkung: partial

Zeitverlauf

ID reserviert2025-10-29
Veröffentlicht2025-10-29 07:08
Bei IP-DB eingegangen2026-10-25 00:00
Zuletzt aktualisiert2026-06-17 12:54

Vergeben von (CNA): Patchstack
NVD-Status: Deferred

In der Quelle ansehen: CVE.org · NVD

Benachrichtigung bei neuen Schwachstellen in diesen Produkten

E-Mail-Warnungen aktivieren

Kostenlos · mit Konto · jederzeit abbestellbar

Neue CVEs im selben Produkt — WordPress plugins & themes

Ohne Score

CVE-2026-118167 vor 1 Stunde

MC4WP: Mailchimp for WordPress < 4.15.0 - Unauthenticated Subscription Audience Override

MC4WP: Mailchimp for WordPress

The MC4WP: Mailchimp for WordPress plugin before 4.15.0 does not validate that the Mailchimp audience a sign-up form or bundled integration subscribes a visitor to matches the audience configured by the site owner, allowing unauthenticated visitors to subscri…

Ohne Score

CVE-2026-118186 vor 1 Stunde

PublishPress Revisions 3.6.0 - 4.2.0 - Contributor+ Unapproved Content Publishing via Revision Workflow

PublishPress Revisions: Duplicate Posts, Submit, Approve and Schedule Content Changes

The PublishPress Revisions: Duplicate Posts, Submit, Approve and Schedule Content Changes WordPress plugin before 4.3.1 does not correctly restrict who may publish content, allowing users such as Contributors who can edit but not publish to make unreviewed po…

Ohne Score

CVE-2026-118187 vor 1 Stunde

PublishPress Revisions < 4.3.1 - Contributor+ Unpublished Content Disclosure via IDOR

PublishPress Revisions: Duplicate Posts, Submit, Approve and Schedule Content Changes

The PublishPress Revisions: Duplicate Posts, Submit, Approve and Schedule Content Changes WordPress plugin before 4.3.1 does not verify that a user requesting to duplicate or revise a post has access to that specific post, only that they can edit posts of tha…

Ohne Score

CVE-2026-118188 vor 1 Stunde

PublishPress Revisions 3.9.0 - 4.2.0 - Subscriber+ Unpublished Content Disclosure

PublishPress Revisions: Duplicate Posts, Submit, Approve and Schedule Content Changes

The PublishPress Revisions: Duplicate Posts, Submit, Approve and Schedule Content Changes WordPress plugin before 4.3.1 does not verify that a user is permitted to read a given post before returning its content through its revision-comparison feature, allowin…

Ohne Score

CVE-2026-118239 vor 1 Stunde

AutomatorWP < 6.0.7 - Unauthenticated Zoom/AWeber Integration Connection Hijack via OAuth Callback

AutomatorWP

The AutomatorWP WordPress plugin before 6.0.7 does not check that the user completing its Zoom and AWeber integration connections is allowed to do so, allowing unauthenticated attackers to replace the stored integration credentials with their own and divert …

Ohne Score

CVE-2026-110813 vor 1 Stunde

Advanced Custom Fields (ACF®) < 6.8.11 - Unauthenticated Stored XSS via HTML Attribute Name Injection

Advanced Custom Fields (ACF®)

The Advanced Custom Fields (ACF®) WordPress plugin before 6.8.11 does not properly sanitize a stored field definition that can be modified through its comment handling, allowing unauthenticated users to inject a payload that is emitted as an HTML attribute na…