CVE-2022-3477: tagDiv Composer < 3.5 - Unauthenticated Account Takeover
The tagDiv Composer WordPress plugin before 3.5, required by the Newspaper WordPress theme before 12.1 and Newsmag WordPress theme before 5.2.2, does not properly implement the Facebook login feature, allowing unauthenticated attackers to login as any user by just knowing their email address
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2022-3477?
CVE-2022-3477 has a severity rating that indicates it allows unauthenticated attackers to exploit the Facebook login feature.
How do I fix CVE-2022-3477?
To fix CVE-2022-3477, update the tagDiv Composer plugin to version 3.5 or later, and ensure the Newspaper theme is updated to version 12.1 or later, or the Newsmag theme to version 5.2.2 or later.
What versions are affected by CVE-2022-3477?
CVE-2022-3477 affects tagDiv Composer versions below 3.5, Newspaper theme versions below 12.1, and Newsmag theme versions below 5.2.2.
Who can exploit CVE-2022-3477?
CVE-2022-3477 can be exploited by unauthenticated attackers who know the email addresses of users.
What impact does CVE-2022-3477 have on users?
CVE-2022-3477 allows attackers to login as any user, which can lead to unauthorized access and potential data breaches.