Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

facebookincubator/facebook-for-woocommerce

              main @ 1e52cb6
            

Fixes

CVEs

CRITICAL

Peak severity

57.1%

Coverage

Highlights

Auth Bypass: 6 prior fixes. Scrutinize any change in this area.

facebook-commerce.php: most-fixed (9 issues). Treat as high-risk during review.

17 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Auth Bypass: Multiple AJAX and REST endpoints historically lacked proper capability and nonce checks, allowing unauthenticated or low-privileged users to trigger privileged operations like product sync, option updates, and settings changes. Webhook authentication used a weak HMAC key (external_business_id) that could be forged.

CSRF: A large set of AJAX handlers (product visibility, infobanner, reset/delete/sync products, settings save/update/delete) lacked nonce validation, enabling cross-site request forgery that could alter plugin state and product data. Multiple fixes added nonce checks, but the breadth of handlers suggests ongoing risk of missing checks on new or sibling endpoints.

Information Disclosure: Sensitive user data (user_info) was exposed in pixel output, and product catalog data was made publicly accessible via a CSV feed URL. These leaks could expose customer PII and product information to unauthorized parties.