CVE-2022-3180

CVE-2022-3180 is a privilege escalation vulnerability affecting the WPGateway Plugin for WordPress in versions up to and including 3.5. It enables unauthenticated attackers to create arbitrary malicious administrator accounts, earning a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) and mapping to CWE-290.

Unauthenticated attackers can exploit this vulnerability remotely over the network with low complexity and no user interaction required. Successful exploitation allows attackers to gain full administrative control of the affected WordPress site by registering new administrator accounts, potentially leading to complete site compromise including data theft, modification, or deletion.

Wordfence advisories detail the vulnerability and recommend updating the WPGateway plugin beyond version 3.5 to mitigate the issue, as referenced in their threat intelligence report and public service announcement.

This zero-day vulnerability has been actively exploited in the wild, as noted in Wordfence's September 2022 blog post.