Alert: Active Exploitation of Zero-Day Vulnerability in WPGateway Plugin in WordPress

The Wordfence Threat Intelligence team, the WordPress security firm, identified a zero-day vulnerability (CVE-2022-3180) in the WPGateway plugin of Wordpress. The WPGateway plugin enables its users to setup and manage WordPress sites from a single dashboard.

• CVE-2022-3180: Unauthenticated privilege escalation

Security Risks

When the identified vulnerability is exploited, it allows a malicious actor to add a new user with administrator privileges to sites running the WPGateway plugin.

For more details on the vulnerability, please refer to the Wordfence published note.      

Recommended Actions

The National Cyber Security Authority (NCSA) recommends users and administrators to:

1. Upgrade, as soon as possible, to the latest supported version of WordPress CMS in order to continue receiving technical support and security patches.

The latest WordPress releases, to upgrade to, is:

• WordPress 6.0.2

2. Remove the WPGateway plugin from your WordPress site, until a security patch is provided. For more information, please refer to the Wordfence published note.

3. Before any update task, ensure you have backup for your data.

For further information and support, please contact the National Cyber Security Authority (NCSA) by emailto rwcsirt@ncsa.gov.rw or call us on 9009

References

Wordfence PSA