CVE-2022-3180
Published: 11 February 2025
Summary
CVE-2022-3180 is a critical-severity Authentication Bypass by Spoofing (CWE-290) vulnerability in Wpgateway Wpgateway. Its CVSS base score is 9.8 (Critical).
Operationally, ranked in the top 4.0% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 AC-2 (Account Management) and SI-2 (Flaw Remediation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly mitigates CVE-2022-3180 by requiring timely identification, prioritization, and patching of the flaw in the WPGateway plugin versions up to 3.5.
Prevents and detects unauthorized privilege escalation by enforcing automated and manual processes for account provisioning, modification, review, and disabling of malicious administrator accounts created via the vulnerability.
Enables identification of exploitation of CVE-2022-3180 through real-time monitoring of anomalous activities such as unauthenticated account creations or privilege changes.
NVD Description
The WPGateway Plugin for WordPress is vulnerable to privilege escalation in versions up to, and including, 3.5. This allows unauthenticated attackers to create arbitrary malicious administrator accounts.
Deeper analysisAI
CVE-2022-3180 is a privilege escalation vulnerability affecting the WPGateway Plugin for WordPress in versions up to and including 3.5. It enables unauthenticated attackers to create arbitrary malicious administrator accounts, earning a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) and mapping to CWE-290.
Unauthenticated attackers can exploit this vulnerability remotely over the network with low complexity and no user interaction required. Successful exploitation allows attackers to gain full administrative control of the affected WordPress site by registering new administrator accounts, potentially leading to complete site compromise including data theft, modification, or deletion.
Wordfence advisories detail the vulnerability and recommend updating the WPGateway plugin beyond version 3.5 to mitigate the issue, as referenced in their threat intelligence report and public service announcement.
This zero-day vulnerability has been actively exploited in the wild, as noted in Wordfence's September 2022 blog post.
Details
- CWE(s)