CVE-2022-3180

CVE-2022-3180: WPGateway <= 3.5 - Unauthenticated Privilege Escalation

Vendor Jack Hopman

Product WPGateway

Weakness CWE-290

Published February 11, 2025

Last update March 14, 2025

View on NVD All CVEs

CVSS base score

—

What the vulnerability does

01Description

The WPGateway Plugin for WordPress is vulnerable to privilege escalation in versions up to, and including, 3.5. This allows unauthenticated attackers to create arbitrary malicious administrator accounts.

Key dates

02Disclosure timeline

February 11, 2025 CVE published

March 14, 2025 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2022-3180 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/290.html AskarLabs — CWE-290 write-up Authentication Bypass by Spoofing

Related vulnerabilities

04Related CVE

CVE-2023-37865 WordPress IP2Location Country Blocker plugin <= 2.29.1 - IP Bypass Vulnerability vulnerability CVE-2025-69401 WordPress WooODT Lite plugin <= 2.5.2 - Payment Bypass Vulnerability vulnerability CVE-2026-27089 WordPress WpTravelly plugin <= 2.1.7 - Bypass Vulnerability vulnerability CVE-2024-30479 WordPress LionScripts: IP Blocker Lite plugin <= 11.1.1 - Bypass vulnerability CVE-2024-32827 WordPress Giveaways and Contests by RafflePress plugin <= 1.12.7 - IP Restriction Bypass vulnerability