CVE-2022-3477

The tagDiv Composer WordPress plugin before 3.5, required by the Newspaper WordPress theme before 12.1 and Newsmag WordPress theme before 5.2.2, does not properly implement the Facebook login feature, allowing unauthenticated attackers to login as any user by just knowing their email address

CVSS v3.1

9.8 CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CVSS v3.1

9.8 CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS

3.58% chance of exploitation in the next 30 days, 89th percentile

Nuclei

critical · CWE-287

Published

2022-11-14

Updated

2025-04-30

Proof-of-concept exploits (1)

• https://wpscan.com/vulnerability/993a95d2-6fce-48de-ae17-06ce2db829ef

Nuclei templates (1)

• projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-3477.yaml

References

• CVE Record
• NVD entry

Related

• CVE-2022-34753
• CVE-2022-3481
• CVE-2022-3473
• CVE-2022-3484
• CVE-2022-3472
• CVE-2022-34845