CVE-2022-3477: Newsmag Project Newsmag

Critical severity, CVSS 9.8. EPSS: 3.8% chance of exploitation in the next 30 days.

The tagDiv Composer WordPress plugin before 3.5, required by the Newspaper WordPress theme before 12.1 and Newsmag WordPress theme before 5.2.2, does not properly implement the Facebook login feature, allowing unauthenticated attackers to login as any user by just knowing their email address

Affected products

• Newsmag Project Newsmag: before 5.2.2 (fixed in 5.2.2)
• Newspaper Project Newspaper: before 12.1 (fixed in 12.1)
• Tagdiv Composer Project Tagdiv Composer: before 3.5 (fixed in 3.5)

Published 2022-11-14. Last modified 2026-06-17.