• Language chooser
    • USA (English)
    • France (Français)

WordPress WPGateway Plugin Vulnerability

Released: Sep 20, 2022


Medium Severity

WordPress Vendor

Vulnerability Type

Zero-day in WPGateway WordPress plugin actively being exploited.

The WPGateway plugin vulnerability can allow an unauthenticated remote attacker to add a malicious user with admin privileges and completely take over the WordPress sites. Learn More »

Common Vulnerabilities and Exposures

CVE-2022-3180

Background

The WPGateway is a premium plugin which is offered as a part of WPGateway cloud service that lets users setup and manage WordPress sites from a single dashboard. On September 8, 2022, Wordfence became aware of this actively exploited zero-day vulnerability being targeted in the wild.

Latest Development

Recent news and incidents related to cybersecurity threats encompassing various events such as data breaches, cyber-attacks, security incidents, and vulnerabilities discovered.


September 9, 2022: Wordfence disclosed the vulnerability to the WPGateway plugin vendor.


September 13, 2022: Wordfence posted a blog about the vulnerability and released a public service announcement stating over 280 thousand WordPress sites have been attacked. If using WordPress for websites, FortiGuard Labs recommends having a WAF in place, such as FortiWeb Cloud, a cloud native SaaS based web application firewall (WAF) that protects web applications & APIs from zero-day attacks, other application layer attacks and requires no changes to your sites. FortiWeb Cloud WAF-as-a-Service: https://www.fortiweb-cloud.com

FortiGuard Cybersecurity Framework

Mitigate security threats and vulnerabilities by leveraging the range of FortiGuard Services.


PROTECT
  • Decoy VM

  • IPS

  • Web App Security

  • Post-execution

DETECT
  • Outbreak Detection

  • Threat Hunting

  • Content Update

RESPOND
  • Assisted Response Services

  • Automated Response

RECOVER
  • InfoSec Services

IDENTIFY
  • Attack Surface Monitoring (Inside & Outside)

Threat Intelligence

Information gathered from analyzing ongoing cybersecurity events including threat actors, their tactics, techniques, and procedures (TTPs), indicators of compromise (IOCs), malware and related vulnerabilities.


Loading ...

Indicators of compromise Indicators of compromise
IOC Threat Activity

Last 30 days

Chg

Avg 0