CVE:CVE-2022-3477
CNNVD:CNNVD-202211-2691
WordPress和WordPress plugin都是WordPress基金会的产品。WordPress是一套使用PHP语言开发的博客平台。该平台支持在PHP和MySQL的服务器上架设个人博客网站。WordPress plugin是一个应用插件。
WordPress plugin tagDiv Composer 3.5 版本之前存在授权问题漏洞，该漏洞源于没有正确实现 Facebook 登录功能。未经身份验证的攻击者在知道电子邮件地址的情况下可以作为任何用户登录。
solution:Upgrade newsmag_project newsmag to a higher version than 5.2.2,and avoid the version (,5.2.2); Upgrade newspaper_project newspaper to a higher version than 12.1,and avoid the version (,12.1); Upgrade tagdiv_composer_project tagdiv_composer to a higher version than 3.5,and avoid the version (,3.5)