WordPress CVEs

Description

The tagDiv Composer WordPress plugin before 3.5, required by the Newspaper WordPress theme before 12.1 and Newsmag WordPress theme before 5.2.2, does not properly implement the Facebook login feature, allowing unauthenticated attackers to login as any user by just knowing their email address

Affected WordPress components

• NewsMag Theme · newsmag
  Confirmed match Abandoned
  From 5.2.2 (including) to 5.2.2 (excluding); Before 5.2.2
  View on WordPress.org
• newspaper Plugin · newspaper
  Possible match Homeless
  From 12.1 (including) to 12.1 (excluding); Before 12.1
  View on WordPress.org
• newspaper Theme · newspaper
  Possible match Homeless
  From 12.1 (including) to 12.1 (excluding); Before 12.1
  View on WordPress.org

A confirmed match is backed by the plugin or theme slug. A possible match is based on the product name only and should be verified.

Affected products and versions

• tagDiv tagDiv Composer — From 3.5 (including) to 3.5 (excluding)
• tagDiv Newspaper — From 12.1 (including) to 12.1 (excluding)
• tagDiv Newsmag — From 5.2.2 (including) to 5.2.2 (excluding)
• newsmag_project newsmag — Before 5.2.2
• newspaper_project newspaper — Before 12.1
• tagdiv_composer_project tagdiv_composer — Before 3.5

References

• wpscan.com https://wpscan.com/vulnerability/993a95d2-6fce-48de-ae17-06ce2db829ef Exploit, Third Party Advisory
• nvd.nist.gov Official NVD record