CVE-2022-3180criticalexplotación observadaCWE-290

WPGateway <= 3.5 - Unauthenticated Privilege Escalation

50Vexday Risk Score

Prioriza la corrección. Ella explotación observada por VulnCheck.

ssvc Actcvss 9.8epss 9.2%

de la publicación al arma

Publicada en NVD11 feb

VulnCheck13 sept

probabilidad de explotación

9.2%top 5% de las CVE

explotación observada

síVulnCheck

The WPGateway Plugin for WordPress is vulnerable to privilege escalation in versions up to, and including, 3.5. This allows unauthenticated attackers to create arbitrary malicious administrator accounts.

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Productos afectados

Jack Hopman · WPGateway

Referencias

https://www.wordfence.com/blog/2022/09/psa-zero-day-vulnerability-in-wpgateway-actively-exploited-in-the-wild/https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/wpgateway/wpgateway-35-unauthenticated-privilege-escalation