CVE-2022-3180

critical · 9.8

The WPGateway Plugin for WordPress is vulnerable to privilege escalation in versions up to, and including, 3.5. This allows unauthenticated attackers to create arbitrary malicious administrator accounts.

9.8

CVSS

9.2%

EPSS (exploit prob.)

95th

EPSS percentile

2025-02-11

Published

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weaknesses

CWE-290

Affected products

Vendor	Product	Affected versions
wpgateway	wpgateway	<= 3.5

Check a specific version with /api/v1/cve/match.

References

https://www.wordfence.com/blog/2022/09/psa-zero-day-vulnerability-in-wpgateway-actively-exploited-in-the-wild/
https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/wpgateway/wpgateway-35-unauthenticated-privilege-escalation

Query this programmatically:

curl https://evil-db.io/api/v1/cve/CVE-2022-3180