Improper Authorization in WPGateway - CVE-2022-3180
Published: September 14, 2022
Vulnerability identifier: #VU67294
CSH Severity: Critical
CVSS v4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:A/U:Red
CVE-ID: CVE-2022-3180
CWE-ID: CWE-285
Exploitation vector: Remote access
Exploit availability:
The vulnerability is being exploited in the wild
Vendor: WPGateway
Affected software:
WPGateway
WPGateway
Detailed vulnerability description
The vulnerability allows a remote attacker to compromise the web application.
The vulnerability exists due to missing authorization checks. A remote non-authenticated attacker can send a specially crafted request to the affected plugin and add an administrative user account into your WordPress installation.
Successful exploitation of the vulnerability may allow an attacker to execute arbitrary PHP code on the server.
Note, the vulnerability is being actively exploited in the wild as of September 8.
How to mitigate CVE-2022-3180
Cybersecurity Help is currently unaware of any official solution to address this vulnerability.