VYPR
← All advisories
Unrated severityNVD Advisory· Published Nov 14, 2022· Updated Apr 30, 2025

tagDiv Composer < 3.5 - Unauthenticated Account Takeover

CVE-2022-3477

Description

The tagDiv Composer WordPress plugin before 3.5, required by the Newspaper WordPress theme before 12.1 and Newsmag WordPress theme before 5.2.2, does not properly implement the Facebook login feature, allowing unauthenticated attackers to login as any user by just knowing their email address

Affected products

3
  • tagDiv/tagDiv Composerv5
    Range: 3.5
  • Tagdiv/Newspaperv5
    Range: 12.1
  • tagDiv/Newsmagv5
    Range: 5.2.2

Patches

0

No patches discovered yet.

Vulnerability mechanics

AI mechanics synthesis has not run for this CVE yet.

References

1

News mentions

0

No linked articles in our index yet.