PT-2022-22320 · Tagdiv · Newspaper+2

Truoc Phan · Published 2022-11-14 · Updated 2026-04-14 · CVE-2022-3477

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions tagDiv Composer WordPress plugin versions prior to 3.5 Newspaper WordPress theme versions prior to 12.1 Newsmag WordPress theme versions prior to 5.2.2

Description The issue concerns the improper implementation of the Facebook login feature, allowing unauthenticated attackers to login as any user by just knowing their email address.

Recommendations For tagDiv Composer WordPress plugin versions prior to 3.5, update to version 3.5 or later. For Newspaper WordPress theme versions prior to 12.1, update to version 12.1 or later. For Newsmag WordPress theme versions prior to 5.2.2, update to version 5.2.2 or later.

Exploit

Fix

Improper Authentication

Weakness Enumeration

CWE-287

Related Identifiers

CVE-2022-3477

Affected Products

Newsmag

Newspaper

Tagdiv Composer

References · 7

• 🔥 https://wpscan.com/vulnerability/993a95d2-6fce-48de-ae17-06ce2db829ef · Exploit
• https://osv.dev/vulnerability/CVE-2022-3477 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-3477 · Security Note
• https://t.me/cvenotify/120384 · Telegram Post
• https://twitter.com/pdnuclei_bot/status/1970412863127695360 · Twitter Post
• https://twitter.com/ctiwatchcloud/status/2043857112686583815 · Twitter Post
• https://twitter.com/pdnuclei/status/1950375855189803139 · Twitter Post