CVE-2022-3180

9.8 criticalEPSS 9.2%

Critical (9.8) in wpgateway wpgateway. EPSS 9.2% chance of exploitation in the next 30 days.

The WPGateway Plugin for WordPress is vulnerable to privilege escalation in versions up to, and including, 3.5. This allows unauthenticated attackers to create arbitrary malicious administrator accounts.

Severity

CVSS 3.1

9.8 critical

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS: 9.2% chance of exploitation in the next 30 days; higher than 95% of CVEs (scores of 2026-10-31)
CWE: CWE-290
Published: 2025-02-11
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

wpgateway:wpgateway

References

https://www.wordfence.com/blog/2022/09/psa-zero-day-vulnerability-in-wpgateway-actively-exploited-in-the-wild/
https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/wpgateway/wpgateway-35-unauthenticated-privilege-escalation

Check your stack JSON