CVE-2022-3477: newsmag_project newsmag Improper Authentication
Vulnerability summary
CVE-2022-3477 is a critical (CVSS 9.8) Improper Authentication vulnerability in newsmag_project newsmag. EPSS estimates a 3.90% chance of exploitation in the next 30 days, higher than 90.2% of scored vulnerabilities. 1 public exploit is recorded. Fixed in 5.2.2.
Timeline
- 14-11-2022PublishedVulnerability first disclosed.
- 30-04-2025Last modifiedVulnerability information updated.
Description
The tagDiv Composer WordPress plugin before 3.5, required by the Newspaper WordPress theme before 12.1 and Newsmag WordPress theme before 5.2.2, does not properly implement the Facebook login feature, allowing unauthenticated attackers to login as any user by just knowing their email address
CVSS metrics
3 scores · 3 sources · 1 version- NVDNIST9.8CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- wordfenceSource9.8CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS trend
Probability
3.90%
Chance of exploitation in the next 30 days
Percentile
90%
Versus all other CVEs
30-day change
+0.08 pp
From 3.83% on 21-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
1 foundExploit Reference (wpscan.com)
Maturity: unknown
Weaknesses
CWE · root cause- CWE-287Improper AuthenticationWhen an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.
- CWE-288Authentication Bypass Using an Alternate Path or ChannelThe product requires authentication, but the product has an alternate path or channel that does not require authentication.
Affected systems
Tagdiv3 products
- newsmag≥ 5.2.2, < 5.2.2
- newspaper≥ 12.1, < 12.1
- tagdiv_composer≥ 3.5, < 3.5
Wordpress3 products
- td-composer< 3.5
- newsmag≤ 5.2.1 (fixed in 5.2.2)
- newspaper≤ 12 (fixed in 12.1)
Newsmag_project1 product
- newsmag< 5.2.2
Newspaper_project1 product
- newspaper< 12.1
Tagdiv_composer_project1 product
- tagdiv_composer< 3.5
5 vendors · 9 products