CVE-2022-3477

CVE-2022-3477: tagDiv Composer < 3.5 - Unauthenticated Account Takeover

Vendor Tagdiv
Product tagDiv Composer
Weakness CWE-287 · Improper authentication
Published November 14, 2022
Last update April 30, 2025
View on NVD All CVEs

CVSS base score

—

What the vulnerability does

01Description

The tagDiv Composer WordPress plugin before 3.5, required by the Newspaper WordPress theme before 12.1 and Newsmag WordPress theme before 5.2.2, does not properly implement the Facebook login feature, allowing unauthenticated attackers to login as any user by just knowing their email address

Key dates

02Disclosure timeline

November 14, 2022 CVE published
April 30, 2025 Record updated