1. Home
  2. CVE Database
  3. CVE-2022-3477
CRITICAL · 9.8

CVE-2022-3477

The tagDiv Composer WordPress plugin before 3.5, required by the Newspaper WordPress theme before 12.1 and Newsmag WordPress theme before 5.2.2, does not properly implement the Facebook login feature,...

Vulnerability Description

The tagDiv Composer WordPress plugin before 3.5, required by the Newspaper WordPress theme before 12.1 and Newsmag WordPress theme before 5.2.2, does not properly implement the Facebook login feature, allowing unauthenticated attackers to login as any user by just knowing their email address

CVSS Score

9.8

CRITICAL

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality
HIGH
Integrity
HIGH
Availability
HIGH

Affected Products

VendorProductVersions
Newsmag ProjectNewsmag< 5.2.2
Newspaper ProjectNewspaper< 12.1
Tagdiv Composer ProjectTagdiv Composer< 3.5

Related Weaknesses (CWE)

CWE-287

References

FAQ

What is CVE-2022-3477?

CVE-2022-3477 is a vulnerability with a CVSS score of 9.8 (CRITICAL). The tagDiv Composer WordPress plugin before 3.5, required by the Newspaper WordPress theme before 12.1 and Newsmag WordPress theme before 5.2.2, does not properly implement the Facebook login feature,...

How severe is CVE-2022-3477?

CVE-2022-3477 has been rated CRITICAL with a CVSS base score of 9.8/10. This is considered a critical vulnerability requiring immediate attention.

Is there a patch for CVE-2022-3477?

Check the references section above for vendor advisories and patch information. Affected products include: Newsmag Project Newsmag, Newspaper Project Newspaper, Tagdiv Composer Project Tagdiv Composer.