Description
The tagDiv Composer WordPress plugin before 3.5, required by the Newspaper WordPress theme before 12.1 and Newsmag WordPress theme before 5.2.2, does not properly implement the Facebook login feature, allowing unauthenticated attackers to login as any user by just knowing their email address
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| tagDiv | tagDiv Composer | 3.5 – < 3.5 | 3.5 |
| tagDiv | Newspaper | 12.1 – < 12.1 | 12.1 |
| tagDiv | Newsmag | 5.2.2 – < 5.2.2 | 5.2.2 |
Automated scanner template
A ready-made Nuclei template detects this vulnerability automatically. Vulnerabilities with public scanner templates are typically probed across the internet soon after the template appears — exposed systems should be patched first.
- WordPress tagDiv Composer < 3.5 - Authentication Bypass http/cves/2022/CVE-2022-3477.yaml
Source: projectdiscovery/nuclei-templates (MIT) — updated daily. Only links are listed.