What’s Vulnerable › Vulnerabilities

CVE-2022-3477: tagDiv Composer < 3.5 - Unauthenticated Account Takeover

• Severity: critical (CVSS 9.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 3.9% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2022-11-14 · updated 2026-06-17
• Weakness: CWE-287

Description

The tagDiv Composer WordPress plugin before 3.5, required by the Newspaper WordPress theme before 12.1 and Newsmag WordPress theme before 5.2.2, does not properly implement the Facebook login feature, allowing unauthenticated attackers to login as any user by just knowing their email address

Affected products

• Newsmag Project Newsmag: before 5.2.2 — fixed in 5.2.2
• Newspaper Project Newspaper: before 12.1 — fixed in 12.1
• Tagdiv Composer Project Tagdiv Composer: before 3.5 — fixed in 3.5

How to fix

Upgrade to a fixed version: Newsmag Project Newsmag 5.2.2; Newspaper Project Newspaper 12.1; Tagdiv Composer Project Tagdiv Composer 3.5. Check the vendor advisory for mitigations.

References

• https://wpscan.com/vulnerability/993a95d2-6fce-48de-ae17-06ce2db829ef
• https://wpscan.com/vulnerability/993a95d2-6fce-48de-ae17-06ce2db829ef

Get alerted when CVE-2022-3477 or the next vulnerability affects your stack