tagDiv Composer < 3.5 - Unauthenticated Account Takeover
Priority HIGH 82CWE-287Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA. Impact type from CWE-287.
Summary
The tagDiv Composer WordPress plugin before 3.5, required by the Newspaper WordPress theme before 12.1 and Newsmag WordPress theme before 5.2.2, does not properly implement the Facebook login feature, allowing unauthenticated attackers to login as any user by just knowing their email address
Why it matters now
Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.03985 90th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed tagDiv Composer (tagDiv): 3.5Newspaper (tagDiv): 12.1+1 more product
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- Yes
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| tagDiv | tagDiv Composer | 3.5 to before 3.5 | 3.5 | Patch available | CNA |
| tagDiv | Newspaper | 12.1 to before 12.1 | 12.1 | Patch available | CNA |
| tagDiv | Newsmag | 5.2.2 to before 5.2.2 | 5.2.2 | Patch available | CNA |
- tagDiv Composer VendortagDiv Affected 3.5 to before 3.5 Fixed in 3.5 Patch available CNA
- Newspaper VendortagDiv Affected 12.1 to before 12.1 Fixed in 12.1 Patch available CNA
- Newsmag VendortagDiv Affected 5.2.2 to before 5.2.2 Fixed in 5.2.2 Patch available CNA
CPE configurations NVD · 3
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:newsmag_project:newsmag:*:*:*:*:*:wordpress:*:* | before 5.2.2 | Vulnerable | Newsmag Project |
| cpe:2.3:a:newspaper_project:newspaper:*:*:*:*:*:wordpress:*:* | before 12.1 | Vulnerable | Newspaper Project |
| cpe:2.3:a:tagdiv_composer_project:tagdiv_composer:*:*:*:*:*:wordpress:*:* | before 3.5 | Vulnerable | Tagdiv Composer Project |
- cpe:2.3:a:newsmag_project:newsmag:*:*:*:*:*:wordpress:*:* Versions before 5.2.2 Vulnerable ·Newsmag Project
- cpe:2.3:a:newspaper_project:newspaper:*:*:*:*:*:wordpress:*:* Versions before 12.1 Vulnerable ·Newspaper Project
- cpe:2.3:a:tagdiv_composer_project:tagdiv_composer:*:*:*:*:*:wordpress:*:* Versions before 3.5 Vulnerable ·Tagdiv Composer Project
Remediation
- Fix · CNA tagDiv Composer (tagDiv) Fixed in 3.5
- Fix · CNA Newspaper (tagDiv) Fixed in 12.1
- Fix · CNA Newsmag (tagDiv) Fixed in 5.2.2
Timeline
- 2026-10-02 Threatist record created from CVE-2022-3477
- 2026-10-03 Alias added: GHSA-657r-v7qf-78qr
- 2026-10-20 EPSS moved to the 90th–95th percentile
References
More tagDiv vulnerabilities
- TI-2023-01506 tagDiv Cloud Library < 2.7 - Unauthenticated Arbitrary User Metadata Update to Privilege Escalation CVSS 3.1HIGH 8.8
- TI-2023-02969 tagDiv Composer < 4.2 - Unauthenticated Stored XSS CVSS 3.1MEDIUM 6.1
- TI-2023-01505 tagDiv Composer < 4.0 - Reflected Cross-site Scripting CVSS 3.1MEDIUM 6.1
- TI-2022-02429 Newspaper < 12 - Reflected Cross-Site Scripting CVSS 3.1MEDIUM 6.1
- TI-2022-02005 Newspaper < 12 - Reflected Cross-Site Scripting CVSS 3.1MEDIUM 6.1
- TI-2023-02970 tagDiv Composer < 4.2 - Admin+ Stored XSS CVSS 3.1MEDIUM 4.8
Sources
- CVE-2022-3477 · CVE Program
- CVE-2022-3477 · NVD
- FIRST EPSS
- GHSA-657r-v7qf-78qr · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences