Does Imunify360 protect against CVE-2022-3477?

Issue

The vulnerability in the tagDiv Composer WordPress plugin required by some themes allows unauthenticated attackers to login just by knowing a legit email address. 

Environment

• Imunify360
• WordPress
• TagDiv Composer
• ModSecurity

Solution

Yes. The necessary rules have been added to Imunify360 ModSecurity ruleset version 4.93.

Cause

The Facebook login feature is not properly implemented by the plugin, allowing unauthenticated account takeover.

Useful links

• https://wpscan.com/vulnerability/993a95d2-6fce-48de-ae17-06ce2db829ef