#VU67294 Improper Authorization in WPGateway - CVE-2022-3180
Published: September 14, 2022
Vulnerability identifier: #VU67294
Vulnerability risk: Critical
CVSSv4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:A/U:Red
CVE-ID: CVE-2022-3180
CWE-ID: CWE-285
Exploitation vector: Remote access
Exploit availability:
The vulnerability is being exploited in the wild
Vulnerable software:
WPGateway
WPGateway
Software vendor:
WPGateway
WPGateway
Description
The vulnerability allows a remote attacker to compromise the web application.
The vulnerability exists due to missing authorization checks. A remote non-authenticated attacker can send a specially crafted request to the affected plugin and add an administrative user account into your WordPress installation.
Successful exploitation of the vulnerability may allow an attacker to execute arbitrary PHP code on the server.
Note, the vulnerability is being actively exploited in the wild as of September 8.
Remediation
Cybersecurity Help is currently unaware of any official solution to address this vulnerability.