A recently discovered zero-day flaw in the latest version of the popular WordPress plugin known as WPGateway has been discovered being actively exploited in the wild, allowing malicious actors to control and completely take over affected sites. The plugin is touted as a means for site admins to install, backup, and clone WordPress plugins and themes from a unified dashboard.

A researcher from Wordfence, Ram Gall, said in the advisory that “Part of the plugin functionality exposes a vulnerability that allows unauthenticated attackers to insert a malicious administrator.”

Tracked as CVE-2022-3180 (CVSS score: 9.8), the issue is being weaponized to add a malicious administrator user to sites running the WPGateway plugin, WordPress security company Wordfence noted.

The most common indicator that a website running the plugin has been compromised is the presence of an administrator with the username “rangex.”

Additionally, the appearance of requests to “//wp-content/plugins/wpgateway/wpgateway-webservice-new.php?wp_new_credentials=1” in the access logs is a sign that the WordPress site has been targeted using the flaw, although it doesn’t necessarily imply a successful breach.