CVE-2022-3477
Assigner: WPScan
Published: 2022-11-14T00:00:00
State: PUBLISHED
title: tagDiv Composer < 3.5 - Unauthenticated Account Takeover
descriptions: value: The tagDiv Composer WordPress plugin before 3.5, required by the Newspaper WordPress theme before 12.1 and Newsmag WordPress theme before 5.2.2, does not properly implement the Facebook login feature, allowing unauthenticated attackers to login as any user by just knowing their email address
affected: vendor: tagDiv
product: tagDiv Composer
versions: version: 3.5
status: affected
lessThan: 3.5
versionType: custom
vendor: tagDiv
product: Newspaper
versions: version: 12.1
status: affected
lessThan: 12.1
versionType: custom
vendor: tagDiv
product: Newsmag
versions: version: 5.2.2
status: affected
lessThan: 5.2.2
versionType: custom
credits: value: Truoc Phan
problemTypes: descriptions: type: CWE
description: CWE-287 Improper Authentication
cweId: CWE-287
x_generator: WPScan CVE Generator
source: discovery: EXTERNAL