CVE-2022-3477

tagDiv Composer < 3.5 - Unauthenticated Account Takeover

State: Published
Severity: 9.8 Critical
Published: Nov 14, 2022
Updated: Apr 30, 2025
Reserved: Oct 12, 2022

Description

The tagDiv Composer WordPress plugin before 3.5, required by the Newspaper WordPress theme before 12.1 and Newsmag WordPress theme before 5.2.2, does not properly implement the Facebook login feature, allowing unauthenticated attackers to login as any user by just knowing their email address

Scores

CVSS	Score	Vector	Source
3.1	9.8 Critical	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	CISA-ADP

Weaknesses

CWE-287 Improper Authentication

Affected Products

Product	Versions
tagDiv ComposertagDiv	3.5 to before 3.5Affected
NewspapertagDiv	12.1 to before 12.1Affected
NewsmagtagDiv	5.2.2 to before 5.2.2Affected

References

https://wpscan.com/vulnerability/993a95d2-6fce-48de-ae17-06ce2db829ef

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.