> ## Content Index
> Fetch the complete content index at: https://capitolcommunicator.com/llms.txt
> Use this file to discover other available public pages before exploring further.

# Over 280,000 WordPress sites attacked using WPGateway plugin zero-day vulnerability, reports The Hacker News
- URL: https://capitolcommunicator.com/over-280000-wordpress-sites-attacked-using-wpgateway-plugin-zero-day-vulnerability-reports-the-hacker-news/
- Published: 2022-09-18T14:12:42.000Z
- Updated: 2022-09-18T14:12:42.000Z
- Author: Capitol Communicator
- Tags: News, #wp-top-center-sponsored, #Import 2026-10-08 18:52

**A flaw in the latest version of a WordPress premium plugin known as** [**WPGateway**](https://www.wpgateway.com/?ref=capitolcommunicator.com) **“is being actively exploited** in the wild, potentially allowing malicious actors to completely take over affected sites,” reports The Hacker News.

The WPGateway plugin is a premium plugin tied to the WPGateway cloud service, which offers its users a way to setup and manage WordPress sites from a single dashboard.

The Hacker News adds: “Tracked as **CVE-2022-3180** (CVSS score: 9.8), the issue is being weaponized to add a malicious administrator user to sites running the WPGateway plugin, WordPress security company Wordfence noted.

“”Part of the plugin functionality exposes a vulnerability that allows unauthenticated attackers to insert a malicious administrator,” Wordfence researcher Ram Gall [said](https://www.wordfence.com/blog/2022/09/psa-zero-day-vulnerability-in-wpgateway-actively-exploited-in-the-wild/?ref=capitolcommunicator.com) in an advisory.

“WPGateway is billed as a means for site administrators to install, backup, and clone WordPress plugins and themes from a unified dashboard.

“The most common indicator that a website running the plugin has been compromised is the presence of an administrator with the username “rangex.”

“Additionally, the appearance of requests to “//wp-content/plugins/wpgateway/wpgateway-webservice-new.php?wp\_new\_credentials=1” in the access logs is a sign that the WordPress site has been targeted using the flaw, although it doesn’t necessarily imply a successful breach.

“Wordfence said it blocked over 4.6 million attacks attempting to take advantage of the vulnerability against more than 280,000 sites in the past 30 days.

“Further details about the vulnerability have been withheld owing to active exploitation and to prevent other actors from taking advantage of the shortcoming. In the absence of a patch, users are recommended to remove the plugin from their WordPress installations until a fix is available.

“The development comes days after Wordfence warned of [in-the-wild abuse](https://thehackernews.com/2022/09/hackers-exploit-zero-day-in-wordpress.html?ref=capitolcommunicator.com) of another zero-day flaw in a WordPress plugin called BackupBuddy.”

More [here](https://thehackernews.com/2022/09/over-280000-wordpress-sites-attacked.html?ref=capitolcommunicator.com).