WordPress WPGateway plugin versions 3.5 and below suffer from an unauthenticated privilege escalation vulnerability.