CVE-2022-3477

published 2022-11-14

CVE-2022-3477: The tagDiv Composer WordPress plugin before 3.5, required by the Newspaper WordPress theme before 12.1 and Newsmag WordPress theme before 5.2.2, does not…

Priority P1 81 critical 9.8 CVSS 3.1

AV N AC L PR N UI N S U C H I H A H

ITW EXPLOIT VulnCheck KEV

The tagDiv Composer WordPress plugin before 3.5, required by the Newspaper WordPress theme before 12.1 and Newsmag WordPress theme before 5.2.2, does not properly implement the Facebook login feature, allowing unauthenticated attackers to login as any user by just knowing their email address

Affected

6 ranges

Vendor	Product	Version range	Fixed in
newsmag_project	newsmag	< 5.2.2	5.2.2
newspaper_project	newspaper	< 12.1	12.1
tagdiv	newsmag	>= 5.2.2 < 5.2.2	5.2.2
tagdiv	newspaper	>= 12.1 < 12.1	12.1
tagdiv	tagdiv_composer	>= 3.5 < 3.5	3.5
tagdiv_composer_project	tagdiv_composer	< 3.5	3.5

Detection & IOCs extracted from sources · hover to see the quote

url /wp-admin/admin-ajax.php↗

command action=td_ajax_fb_login_user&user[email]={{email}}↗

• → Detect unauthenticated POST requests to /wp-admin/admin-ajax.php with the action parameter set to 'td_ajax_fb_login_user' — this is the exploit trigger for the authentication bypass. ↗
• → A successful exploitation attempt returns the string '"success":"You have been successfully logged in!' in the HTTP response body with a 200 status code and content-type text/html. ↗
• → The exploit requires only a victim's email address as input (no password or token), sent via POST body parameter user[email]. Monitor for this parameter pattern in web server logs targeting admin-ajax.php. ↗

• · The Nuclei template requires the victim's email address to be supplied as a variable; the exploit is targeted (email-specific) rather than a blind mass-scan payload. ↗
• · The vulnerability is only present when the tagDiv Composer plugin (< 3.5) is installed alongside the Newspaper (< 12.1) or Newsmag (< 5.2.2) WordPress themes, which are prerequisites for the plugin. ↗

CVSS provenance

nvd v3.1 9.8 CRITICAL CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vulncheck 9.8 CRITICAL

CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-287